Incident: Failed logon burst followed by successful authentication (+2 related findings)

Case: CASE-001
Generated: 2026-09-28 21:11:20 UTC
Status: complete
Severity: CRITICAL
Grouping confidence: high (how strongly findings are linked, not whether an intrusion occurred)
Hosts: WS-2924, WS-6254
Accounts: acct-7085
Window: 2026-08-01 08:00:00 -> 08:06:05 UTC (365s)
Telemetry: generated_auth_execution

This report was produced by an automated investigation. It presents evidence-backed findings for analyst review and does not authorise or perform any response action.

Verdict

Disposition: Malicious
Decided by: deterministic triage of the seed findings
Engine: deterministic
Profile: operational-v6
Model: none (deterministic engine)
Evidence basis: 30 typed observation(s) checked against recorded telemetry; 0 claim(s) rejected by verification; 3 specialist step(s) run (endpoint, identity, attack); 11 tool call(s) served, 0 refused.
Supporting event ids: none cited by the concluding explanations

This system does not compute a confidence score for its verdict. The evidence basis is a count of what was checked, not a measure of how likely the verdict is.

Operational

Profile: operational-v6 (sha256 2710d9dfa320)
Engine: deterministic
Elapsed: 0.1 s
Tokens used: not recorded
Benign guard: none in this profile
No-probe rule: none in this profile
Tool calls: 11 served, 0 refused

Investigation Tree

Initial alert: Failed logon burst followed by successful authentication (+2 related findings)
rules ATH-005, ATH-007, ATH-014; 15 seed event(s): 00bb709b987db814f5f7, 044f5c9c5bf34ddb9030, 0f504253fd98db142c3c, 2dbb1b538a03d94bbf88, 3266b536dc39708fc00c, 3608f02fef656b43e91e, +9 more
↓
ATH investigation (engine deterministic)
- endpoint
  why deterministic priority order; case evidence rests on process_command_line, process_execution, process_lineage telemetry (from ATH-007, ATH-014)
  tools get_events, get_events, process_tree, get_events, process_tree
  new events 1 retrieved; shown: 77646b919268d3358b14
- identity
  why deterministic priority order; case evidence rests on auth_source_attribution, authentication telemetry (from ATH-005)
  tools user_auth_history
  new events 12 retrieved; shown: 77a081a8abe68e4b98fb, ce61a2216c4bafb83a03, 8ef9c0146e5d74005d89, 9e17252a5ff4c89350e3, 0970881ea56161a67f86, 20f4c8a616092dce879f, +6 more
- attack
  why only eligible specialist; case has ATT&CK mappings and domain evidence has been gathered
  tools lookup_technique, lookup_technique, lookup_technique, lookup_technique, lookup_technique
- evidence_verifier
  why validate typed observations against cited telemetry
stopped: no specialist has further useful work on the available evidence
↓
Verdict: Malicious

Reasoning Summary

No model-written reasoning: this run used no model. Its reasoning is the specialist trace in the investigation tree and the findings below.

Executive Summary

This report covers CASE-001, correlating 3 detection finding(s) across 2 host(s) (WS-2924, WS-6254) and 1 account(s) (acct-7085) between 08:00:00 and 08:06:05 UTC on 2026-08-01. The evidence is consistent with activity spanning 4 MITRE ATT&CK tactic(s): Execution -> Persistence -> Credential Access -> Lateral Movement. Each mapping is an interpretation of observed behaviour against a public taxonomy, not a determination that an intrusion occurred. 30 statement(s) below are directly established by telemetry, 14 are evidence-supported inferences, and 0 are explicitly unverified hypotheses requiring analyst confirmation. This report does not authorise or perform any response action. All recommendations below require human review before action is taken.

Attack Timeline

Time	Rule	Severity	User	Host / Movement	ATT&CK	Events
08:00:00	ATH-005	CRITICAL	acct-7085	WS-2924	T1078, T1110.001	`72d5a08e0d2a8522ca5a`, `2dbb1b538a03d94bbf88`, `7b13f31085bbf14dad61`, `6cab6426bbe2ef08ea74`, `00bb709b987db814f5f7`, `3266b536dc39708fc00c`, +7 more
08:06:00	ATH-007	HIGH	acct-7085	WS-2924	T1021.002, T1569.002	`703eeb16d25835efecb7`
08:06:05	ATH-014	HIGH	acct-7085	WS-2924	T1003.002	`ccec78fe2c3fa29b518b`

Findings

Confirmed (FACT) (30)

Confirmed: Authentication event 00bb709b987db814f5f7 records outcome failure.
Evidence: 00bb709b987db814f5f7
Confirmed: Authentication event 044f5c9c5bf34ddb9030 records outcome failure.
Evidence: 044f5c9c5bf34ddb9030
Confirmed: Authentication event 0970881ea56161a67f86 records outcome success.
Evidence: 0970881ea56161a67f86
Confirmed: Authentication event 0f504253fd98db142c3c records outcome success.
Evidence: 0f504253fd98db142c3c
Confirmed: Authentication event 20f4c8a616092dce879f records outcome success.
Evidence: 20f4c8a616092dce879f
Confirmed: Authentication event 2dbb1b538a03d94bbf88 records outcome failure.
Evidence: 2dbb1b538a03d94bbf88
Confirmed: Authentication event 3266b536dc39708fc00c records outcome failure.
Evidence: 3266b536dc39708fc00c
Confirmed: Authentication event 3608f02fef656b43e91e records outcome failure.
Evidence: 3608f02fef656b43e91e
Confirmed: Authentication event 5003aa10b50984605fdb records outcome success.
Evidence: 5003aa10b50984605fdb
Confirmed: Authentication event 67d1611c59fa66806fc5 records outcome success.
Evidence: 67d1611c59fa66806fc5
Confirmed: Authentication event 680a11b09c06415c434a records outcome failure.
Evidence: 680a11b09c06415c434a
Confirmed: Authentication event 6cab6426bbe2ef08ea74 records outcome failure.
Evidence: 6cab6426bbe2ef08ea74
Confirmed: Event 703eeb16d25835efecb7 records process identity sysmon:5b6186501e6faefbb89acd575f1415ab.
Evidence: 703eeb16d25835efecb7
Confirmed: Authentication event 72d5a08e0d2a8522ca5a records outcome failure.
Evidence: 72d5a08e0d2a8522ca5a
Confirmed: Event 77646b919268d3358b14 records process identity sysmon:a985464622e9b1d8aead361db1929408.
Evidence: 77646b919268d3358b14
Confirmed: Authentication event 77a081a8abe68e4b98fb records outcome success.
Evidence: 77a081a8abe68e4b98fb
Confirmed: Authentication event 7b13f31085bbf14dad61 records outcome failure.
Evidence: 7b13f31085bbf14dad61
Confirmed: Authentication event 8673afefe5f419af246a records outcome success.
Evidence: 8673afefe5f419af246a
Confirmed: Authentication event 8ef9c0146e5d74005d89 records outcome success.
Evidence: 8ef9c0146e5d74005d89
Confirmed: Authentication event 96d505a664df60a94a7c records outcome failure.
Evidence: 96d505a664df60a94a7c
Confirmed: Authentication event 9e17252a5ff4c89350e3 records outcome success.
Evidence: 9e17252a5ff4c89350e3
Confirmed: Authentication event b555ce4aa91f923b04ff records outcome success.
Evidence: b555ce4aa91f923b04ff
Confirmed: Authentication event c786d4eda4108402ebd7 records outcome success.
Evidence: c786d4eda4108402ebd7
Confirmed: Event ccec78fe2c3fa29b518b records process identity sysmon:3b438f257d488c7aa682ff0330ba9507.
Evidence: ccec78fe2c3fa29b518b
Confirmed: Authentication event ce61a2216c4bafb83a03 records outcome success.
Evidence: ce61a2216c4bafb83a03
Confirmed: Authentication event dcedb070ce7492a69e6a records outcome success.
Evidence: dcedb070ce7492a69e6a
Confirmed: Authentication event edf4a27fb63329509cc1 records outcome failure.
Evidence: edf4a27fb63329509cc1
Confirmed: Authentication event f0ebb167f3e1fca60b93 records outcome failure.
Evidence: f0ebb167f3e1fca60b93
Confirmed: Process event 703eeb16d25835efecb7 identifies the instance in 77646b919268d3358b14 as its parent.
Evidence: 77646b919268d3358b14, 703eeb16d25835efecb7
Confirmed: Process event ccec78fe2c3fa29b518b identifies the instance in 703eeb16d25835efecb7 as its parent.
Evidence: 703eeb16d25835efecb7, ccec78fe2c3fa29b518b

Assessed (INFERENCE) (14)

Assessed: Unverified summary: On WS-2924, cmd.exe (PID 500) was started by services.exe under account acct-7085.
Evidence: 703eeb16d25835efecb7
Assessed: Unverified summary: Execution chain on WS-2924: wininit.exe -> services.exe -> cmd.exe.
Evidence: 703eeb16d25835efecb7, 77646b919268d3358b14
Assessed: Unverified summary: cmd.exe (PID 500) on WS-2924 spawned 1 child process(es): reg.exe.
Evidence: ccec78fe2c3fa29b518b
Assessed: Unverified summary: On WS-2924, reg.exe (PID 501) was started by cmd.exe under account acct-7085.
Evidence: ccec78fe2c3fa29b518b
Assessed: Unverified summary: Execution chain on WS-2924: wininit.exe -> services.exe -> cmd.exe -> reg.exe.
Evidence: ccec78fe2c3fa29b518b, 703eeb16d25835efecb7, 77646b919268d3358b14
Assessed: Unverified summary: Account 'acct-7085' has 25 authentication events (12 failed, 13 successful) across hosts OFFICE-01, WS-2924.
Evidence: 77a081a8abe68e4b98fb, 72d5a08e0d2a8522ca5a, 2dbb1b538a03d94bbf88, ce61a2216c4bafb83a03, 7b13f31085bbf14dad61, 8ef9c0146e5d74005d89, +19 more
Assessed: Unverified summary: Account 'acct-7085' authenticated from more than one source host: OFFICE-01, WS-6254.
Evidence: 77a081a8abe68e4b98fb, 72d5a08e0d2a8522ca5a, 2dbb1b538a03d94bbf88, ce61a2216c4bafb83a03, 7b13f31085bbf14dad61, 8ef9c0146e5d74005d89, +19 more
Assessed: The 12 failed authentications for 'acct-7085' followed by success are consistent with the account's password having been guessed rather than with ordinary user error. (confidence 0.85)
Evidence: 72d5a08e0d2a8522ca5a, 2dbb1b538a03d94bbf88, 7b13f31085bbf14dad61, 6cab6426bbe2ef08ea74, 00bb709b987db814f5f7, 3266b536dc39708fc00c, +6 more
Assessed: Behaviour cited by ATH-005 is consistent with T1110.001 Brute Force: Password Guessing (Credential Access). Repeated failed authentications for a single account from a single source are consistent with systematically guessing that account's password. (A spray against many accounts would be T1110.003 and is not what was observed.) (confidence 0.90)
Evidence: 72d5a08e0d2a8522ca5a, 2dbb1b538a03d94bbf88, 7b13f31085bbf14dad61, 6cab6426bbe2ef08ea74, 00bb709b987db814f5f7, 3266b536dc39708fc00c, +7 more
Assessed: Behaviour cited by ATH-007 is consistent with T1569.002 System Services: Service Execution (Execution). A command interpreter was started by the Service Control Manager, which is the defining behaviour of executing a payload as a Windows service. (confidence 0.90)
Evidence: 703eeb16d25835efecb7
Assessed: Behaviour cited by ATH-014 is consistent with T1003.002 OS Credential Dumping: Security Account Manager (Credential Access). The SAM hive was saved with reg.exe, which is this sub-technique's defining procedure. (confidence 0.90)
Evidence: ccec78fe2c3fa29b518b
Assessed: Behaviour cited by ATH-005 is consistent with T1078 Valid Accounts (Persistence). A successful authentication followed the failure burst, which is consistent with the account credential now being under adversary control. (confidence 0.60)
Evidence: 72d5a08e0d2a8522ca5a, 2dbb1b538a03d94bbf88, 7b13f31085bbf14dad61, 6cab6426bbe2ef08ea74, 00bb709b987db814f5f7, 3266b536dc39708fc00c, +7 more
Assessed: Behaviour cited by ATH-007 is consistent with T1021.002 Remote Services: SMB/Windows Admin Shares (Lateral Movement). Command output was redirected to an administrative share, indicating the service was driven over an authenticated SMB session from another host. (confidence 0.60)
Evidence: 703eeb16d25835efecb7
Assessed: The case spans 4 ATT&CK tactics (Execution -> Persistence -> Credential Access -> Lateral Movement). Progression across multiple tactics is harder to explain as coincidental than activity confined to one. (confidence 0.80)
Evidence: 00bb709b987db814f5f7, 044f5c9c5bf34ddb9030, 0f504253fd98db142c3c, 2dbb1b538a03d94bbf88, 3266b536dc39708fc00c, 3608f02fef656b43e91e, +9 more

Unconfirmed Hypotheses (0)

None.

Recommended Next Steps

Investigative recommendations for a human analyst. No response action has been taken or is authorised by this report.

Retrieve email gateway or web-proxy logs to establish the initial access vector.
Rationale: No detection in this case targets initial access, so the delivery mechanism (e.g. a phishing attachment) is inferred from process lineage rather than confirmed from delivery telemetry.
Based on: MITRE ATT&CK tactic coverage gap: Initial Access
Independently verify account activity on all hosts in scope (WS-2924, WS-6254) rather than relying solely on the correlated case, in case related activity exists that current detections did not flag.
Rationale: This case spans multiple hosts, which increases the possible blast radius.
Based on: case.is_multi_host
Escalate to a human analyst for validation before any remediation action is taken.
Rationale: This system performs read-only investigation only. It has no capability to disable accounts, isolate hosts, or otherwise remediate, and this report is not authorisation to do so.
Based on: system design constraint

Limitations & Scope

Telemetry underlying this report came from: generated_auth_execution. Field coverage depends entirely on what the originating export or sensor captured; this project's canonical schema does not model every field a real EDR product exposes (e.g. file hashes, signer information, session identifiers), and any of those were dropped during normalization.
ATT&CK mappings are interpretations of observed behaviour against a public taxonomy. They indicate that behaviour is consistent with a technique, not that an adversary performed it.
Grouping confidence describes how strongly correlated findings are linked to each other, not whether an intrusion occurred.
No evidence was found for the following ATT&CK tactics: Initial Access, Discovery, Collection, Exfiltration. Their absence may reflect that the activity did not occur, or that available telemetry cannot observe it.
Typed predicates are checked against recorded telemetry; free-text interpretations are not semantically verified. Missing identity is not a confirmed process link, and recorded event order does not establish causation.
No evidence was found for the following tactics: Collection. Their absence may reflect either that the activity did not occur or that we lack the telemetry to see it.

Investigation Trace

Agents run: endpoint, identity, attack; tool calls made: 11

step 1: endpoint -- deterministic priority order; case evidence rests on process_command_line, process_execution, process_lineage telemetry (from ATH-007, ATH-014)
step 2: identity -- deterministic priority order; case evidence rests on auth_source_attribution, authentication telemetry (from ATH-005)
step 3: attack -- only eligible specialist; case has ATT&CK mappings and domain evidence has been gathered
step 4: stop -- no specialist has further useful work on the available evidence
evidence verification: 30 checked observations; 7 summaries reclassified

Evidence Appendix

All 28 telemetry events underlying this report, chronologically.

Event ID	Time	Device	User	Summary	Image (path class; company)
`72d5a08e0d2a8522ca5a`	08:00:00	WS-2924	acct-7085	failure logon [Network (SMB / share access)] from 10.10.2.8 reason=bad_password
`77646b919268d3358b14`	08:00:00	WS-2924	acct-7085	wininit.exe -> services.exe \| services.exe
`77a081a8abe68e4b98fb`	08:00:00	OFFICE-01	acct-7085	success logon [Interactive (console)] from 10.10.1.5
`2dbb1b538a03d94bbf88`	08:00:20	WS-2924	acct-7085	failure logon [Network (SMB / share access)] from 10.10.2.8 reason=bad_password
`ce61a2216c4bafb83a03`	08:00:29	OFFICE-01	acct-7085	success logon [Interactive (console)] from 10.10.1.5
`7b13f31085bbf14dad61`	08:00:40	WS-2924	acct-7085	failure logon [Network (SMB / share access)] from 10.10.2.8 reason=bad_password
`8ef9c0146e5d74005d89`	08:00:58	OFFICE-01	acct-7085	success logon [Interactive (console)] from 10.10.1.5
`6cab6426bbe2ef08ea74`	08:01:00	WS-2924	acct-7085	failure logon [Network (SMB / share access)] from 10.10.2.8 reason=bad_password
`00bb709b987db814f5f7`	08:01:20	WS-2924	acct-7085	failure logon [Network (SMB / share access)] from 10.10.2.8 reason=bad_password
`9e17252a5ff4c89350e3`	08:01:27	OFFICE-01	acct-7085	success logon [Interactive (console)] from 10.10.1.5
`3266b536dc39708fc00c`	08:01:40	WS-2924	acct-7085	failure logon [Network (SMB / share access)] from 10.10.2.8 reason=bad_password
`0970881ea56161a67f86`	08:01:56	OFFICE-01	acct-7085	success logon [Interactive (console)] from 10.10.1.5
`edf4a27fb63329509cc1`	08:02:00	WS-2924	acct-7085	failure logon [Network (SMB / share access)] from 10.10.2.8 reason=bad_password
`680a11b09c06415c434a`	08:02:20	WS-2924	acct-7085	failure logon [Network (SMB / share access)] from 10.10.2.8 reason=bad_password
`20f4c8a616092dce879f`	08:02:25	OFFICE-01	acct-7085	success logon [Interactive (console)] from 10.10.1.5
`044f5c9c5bf34ddb9030`	08:02:40	WS-2924	acct-7085	failure logon [Network (SMB / share access)] from 10.10.2.8 reason=bad_password
`8673afefe5f419af246a`	08:02:54	OFFICE-01	acct-7085	success logon [Interactive (console)] from 10.10.1.5
`f0ebb167f3e1fca60b93`	08:03:00	WS-2924	acct-7085	failure logon [Network (SMB / share access)] from 10.10.2.8 reason=bad_password
`96d505a664df60a94a7c`	08:03:20	WS-2924	acct-7085	failure logon [Network (SMB / share access)] from 10.10.2.8 reason=bad_password
`67d1611c59fa66806fc5`	08:03:23	OFFICE-01	acct-7085	success logon [Interactive (console)] from 10.10.1.5
`3608f02fef656b43e91e`	08:03:40	WS-2924	acct-7085	failure logon [Network (SMB / share access)] from 10.10.2.8 reason=bad_password
`c786d4eda4108402ebd7`	08:03:52	OFFICE-01	acct-7085	success logon [Interactive (console)] from 10.10.1.5
`5003aa10b50984605fdb`	08:04:21	OFFICE-01	acct-7085	success logon [Interactive (console)] from 10.10.1.5
`dcedb070ce7492a69e6a`	08:04:50	OFFICE-01	acct-7085	success logon [Interactive (console)] from 10.10.1.5
`0f504253fd98db142c3c`	08:05:00	WS-2924	acct-7085	success logon [Network (SMB / share access)] from 10.10.2.8
`b555ce4aa91f923b04ff`	08:05:19	OFFICE-01	acct-7085	success logon [Interactive (console)] from 10.10.1.5
`703eeb16d25835efecb7`	08:06:00	WS-2924	acct-7085	services.exe -> cmd.exe \| cmd.exe /Q /c job.cmd 1> \\127.0.0.1\ADMIN$\job.log 2>&1
`ccec78fe2c3fa29b518b`	08:06:05	WS-2924	acct-7085	cmd.exe -> reg.exe \| reg.exe save HKLM\SAM C:\ProgramData\sam.hiv /y	image not recorded; company 'Microsoft Corporation' (version-info text, not a signature)