DC01-Security.evtx

SUMMARY

- Critical brute-force attack: 847 failed logins in 5 minutes from 185.220.101.47 against Administrator and svc-backup accounts - Audit log was cleared at 02:31 UTC — evidence destruction in progress - DSRM password changed at 02:33 UTC — attacker installed a domain controller backdoor - 3 encoded PowerShell scripts executed — likely payload download and C2 staging - 2 suspicious scheduled tasks created under system-looking names for persistence - svc-backup account added to Domain Admins — unauthorized privilege escalation

RISK

This domain controller shows signs of a complete compromise. The attacker gained initial access via credential attack, escalated to Domain Admin, installed multiple persistence mechanisms, and attempted to cover their tracks by clearing the audit log. If unaddressed, the attacker retains full domain control through the DSRM backdoor even if other access is removed.

KEY EVENTS

- 4625: 847 failed logons in 5 minutes — automated credential attack - 1102: Audit log cleared — anti-forensics, attacker covering tracks - 4794: DSRM password changed — persistent domain backdoor installed - 4104: Encoded PowerShell executed — malware staging likely - 4698: Scheduled tasks created — persistence after reboot - 4728: svc-backup added to Domain Admins — unauthorized privilege grant

RECOMMENDED ACTIONS

1. Isolate DC01 from the network immediately pending forensic investigation 2. Reset the DSRM password on all domain controllers via ntdsutil 3. Remove svc-backup from Domain Admins and audit all privileged group memberships 4. Delete suspicious scheduled tasks: UpdateSync and WindowsDefenderCheck 5. Block 185.220.101.47 at the perimeter firewall 6. Reset credentials for Administrator and svc-backup accounts 7. Enable log forwarding to a remote SIEM before bringing DC01 back online