Loading...
SOCpedia Logo SOCpedia
Timelines

Examples of computer account creation events

123 4741 Accounting Security Logs 18.08.2026 22:41

Events corresponding to suspicious activity are highlighted in yellow and red.

Clear Filter
Matched Events: 27 / Total Events: 27
2026-02-22 01:47:04

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
WS2025$
Subject: Security ID
S-1-5-21-1866865257-1197602910-3272984350-1103
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x6f66af
New Computer Account: Security ID
S-1-5-21-1866865257-1197602910-3272984350-1105
New Computer Account: Account Name
WS2025$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
WS2025$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
2/22/2026 1:47:04 AM
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x80
Attributes: User Account Control
%%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
ws2025.socpedia.net
Attributes: Service Principal Names
HOST/ws2025.socpedia.net RestrictedKrbHost/ws2025.socpedia.net HOST/WS2025 RestrictedKrbHost/WS2025
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
848
ThreadID
928
2026-05-30 12:18:33

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
IIS$
Subject: Security ID
S-1-5-21-1866865257-1197602910-3272984350-1103
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x5400567
New Computer Account: Security ID
S-1-5-21-1866865257-1197602910-3272984350-1109
New Computer Account: Account Name
IIS$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
IIS$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
5/30/2026 12:18:32 PM
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x80
Attributes: User Account Control
%%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
IIS.socpedia.net
Attributes: Service Principal Names
HOST/IIS.socpedia.net RestrictedKrbHost/IIS.socpedia.net HOST/IIS RestrictedKrbHost/IIS
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
848
ThreadID
7300
2026-07-24 21:18:17

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
ADCS$
Subject: Security ID
S-1-5-21-1866865257-1197602910-3272984350-1103
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x2f5a83ba
New Computer Account: Security ID
S-1-5-21-1866865257-1197602910-3272984350-1113
New Computer Account: Account Name
ADCS$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
ADCS$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
7/24/2026 9:18:17 PM
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x80
Attributes: User Account Control
%%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
ADCS.socpedia.net
Attributes: Service Principal Names
HOST/ADCS.socpedia.net RestrictedKrbHost/ADCS.socpedia.net HOST/ADCS RestrictedKrbHost/ADCS
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
900
ThreadID
1984
2026-07-27 21:51:28

A computer account was created (4741 "Security")

DC.socpedia.net
ANONYMOUS LOGON
New Computer Account: Account Name
DC$
Subject: Security ID
S-1-5-7
Subject: Account Name
ANONYMOUS LOGON
Subject: Account Domain
NT AUTHORITY
Subject: Logon ID
0x3e6
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1000
New Computer Account: Account Name
DC$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
DC$
Attributes: Display Name
%%1793
Attributes: User Principal Name
-
Attributes: Home Directory
%%1793
Attributes: Home Drive
%%1793
Attributes: Script Path
%%1793
Attributes: Profile Path
%%1793
Attributes: User Workstations
%%1793
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
516
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x105
Attributes: User Account Control
%%2080 %%2082 %%2088
Attributes: User Parameters
%%1792
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
848
ThreadID
852
2026-07-27 22:25:33

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
ADCS$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x729002
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1106
New Computer Account: Account Name
ADCS$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
ADCS$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
7/27/2026 10:25:33 PM
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x80
Attributes: User Account Control
%%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
ADCS.socpedia.net
Attributes: Service Principal Names
HOST/ADCS.socpedia.net RestrictedKrbHost/ADCS.socpedia.net HOST/ADCS RestrictedKrbHost/ADCS
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
848
ThreadID
3840
2026-07-28 20:23:47

A computer account was created (4741 "Security")

DC.socpedia.net
user01
New Computer Account: Account Name
GHOSTKOLSKHSQ$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1105
Subject: Account Name
user01
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x2b670f8
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1107
New Computer Account: Account Name
GHOSTKOLSKHSQ$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
GHOSTKOLSKHSQ$
Attributes: Display Name
%%1793
Attributes: User Principal Name
-
Attributes: Home Directory
%%1793
Attributes: Home Drive
%%1793
Attributes: Script Path
%%1793
Attributes: Profile Path
%%1793
Attributes: User Workstations
%%1793
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x84
Attributes: User Account Control
%%2082 %%2087
Attributes: User Parameters
%%1792
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
SeMachineAccountPrivilege
Computer
DC.socpedia.net
ProcessID
848
ThreadID
6296
2026-07-28 21:06:23

A computer account was created (4741 "Security")

DC.socpedia.net
user01
New Computer Account: Account Name
GHOSTCKWHLQSM$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1105
Subject: Account Name
user01
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x2c8bbe8
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1108
New Computer Account: Account Name
GHOSTCKWHLQSM$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
GHOSTCKWHLQSM$
Attributes: Display Name
%%1793
Attributes: User Principal Name
-
Attributes: Home Directory
%%1793
Attributes: Home Drive
%%1793
Attributes: Script Path
%%1793
Attributes: Profile Path
%%1793
Attributes: User Workstations
%%1793
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x84
Attributes: User Account Control
%%2082 %%2087
Attributes: User Parameters
%%1792
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
SeMachineAccountPrivilege
Computer
DC.socpedia.net
ProcessID
848
ThreadID
7912
2026-07-29 19:34:26

A computer account was created (4741 "Security")

DC.socpedia.net
user01
New Computer Account: Account Name
GHOSTLAWOZCSX$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1105
Subject: Account Name
user01
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x4ae4b97
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1109
New Computer Account: Account Name
GHOSTLAWOZCSX$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
GHOSTLAWOZCSX$
Attributes: Display Name
%%1793
Attributes: User Principal Name
-
Attributes: Home Directory
%%1793
Attributes: Home Drive
%%1793
Attributes: Script Path
%%1793
Attributes: Profile Path
%%1793
Attributes: User Workstations
%%1793
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x84
Attributes: User Account Control
%%2082 %%2087
Attributes: User Parameters
%%1792
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
SeMachineAccountPrivilege
Computer
DC.socpedia.net
ProcessID
848
ThreadID
5032
2026-07-29 19:38:22

A computer account was created (4741 "Security")

DC.socpedia.net
user01
New Computer Account: Account Name
GHOSTVZAOQCOJ$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1105
Subject: Account Name
user01
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x4b0cc7b
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1110
New Computer Account: Account Name
GHOSTVZAOQCOJ$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
GHOSTVZAOQCOJ$
Attributes: Display Name
%%1793
Attributes: User Principal Name
-
Attributes: Home Directory
%%1793
Attributes: Home Drive
%%1793
Attributes: Script Path
%%1793
Attributes: Profile Path
%%1793
Attributes: User Workstations
%%1793
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x84
Attributes: User Account Control
%%2082 %%2087
Attributes: User Parameters
%%1792
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
SeMachineAccountPrivilege
Computer
DC.socpedia.net
ProcessID
848
ThreadID
5756
2026-07-29 19:49:04

A computer account was created (4741 "Security")

DC.socpedia.net
user01
New Computer Account: Account Name
GHOSTMJICJAVL$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1105
Subject: Account Name
user01
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x4b7212f
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1111
New Computer Account: Account Name
GHOSTMJICJAVL$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
GHOSTMJICJAVL$
Attributes: Display Name
%%1793
Attributes: User Principal Name
-
Attributes: Home Directory
%%1793
Attributes: Home Drive
%%1793
Attributes: Script Path
%%1793
Attributes: Profile Path
%%1793
Attributes: User Workstations
%%1793
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x84
Attributes: User Account Control
%%2082 %%2087
Attributes: User Parameters
%%1792
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
SeMachineAccountPrivilege
Computer
DC.socpedia.net
ProcessID
848
ThreadID
5756
2026-07-29 19:59:04

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
WS2025$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x4bb0b31
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1112
New Computer Account: Account Name
WS2025$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
WS2025$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
7/29/2026 7:59:04 PM
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x80
Attributes: User Account Control
%%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
ws2025.socpedia.net
Attributes: Service Principal Names
HOST/ws2025.socpedia.net RestrictedKrbHost/ws2025.socpedia.net HOST/WS2025 RestrictedKrbHost/WS2025
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
848
ThreadID
3840
2026-07-29 20:10:59

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
IIS$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x4c0132f
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1113
New Computer Account: Account Name
IIS$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
IIS$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
7/29/2026 8:10:59 PM
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x80
Attributes: User Account Control
%%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
IIS.socpedia.net
Attributes: Service Principal Names
HOST/IIS.socpedia.net RestrictedKrbHost/IIS.socpedia.net HOST/IIS RestrictedKrbHost/IIS
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
848
ThreadID
3952
2026-08-02 19:06:37

A computer account was created (4741 "Security")

DC.socpedia.net
user01
New Computer Account: Account Name
GHOSTOJWNQPQU$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1105
Subject: Account Name
user01
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xc67d891
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1114
New Computer Account: Account Name
GHOSTOJWNQPQU$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
GHOSTOJWNQPQU$
Attributes: Display Name
%%1793
Attributes: User Principal Name
-
Attributes: Home Directory
%%1793
Attributes: Home Drive
%%1793
Attributes: Script Path
%%1793
Attributes: Profile Path
%%1793
Attributes: User Workstations
%%1793
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x84
Attributes: User Account Control
%%2082 %%2087
Attributes: User Parameters
%%1792
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
SeMachineAccountPrivilege
Computer
DC.socpedia.net
ProcessID
848
ThreadID
9276
2026-08-02 19:18:56

A computer account was created (4741 "Security")

DC.socpedia.net
user01
New Computer Account: Account Name
GHOSTBLWWJFMQ$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1105
Subject: Account Name
user01
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xc6b2994
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1115
New Computer Account: Account Name
GHOSTBLWWJFMQ$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
GHOSTBLWWJFMQ$
Attributes: Display Name
%%1793
Attributes: User Principal Name
-
Attributes: Home Directory
%%1793
Attributes: Home Drive
%%1793
Attributes: Script Path
%%1793
Attributes: Profile Path
%%1793
Attributes: User Workstations
%%1793
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x84
Attributes: User Account Control
%%2082 %%2087
Attributes: User Parameters
%%1792
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
SeMachineAccountPrivilege
Computer
DC.socpedia.net
ProcessID
848
ThreadID
6296
2026-08-02 19:45:54

A computer account was created (4741 "Security")

DC.socpedia.net
user01
New Computer Account: Account Name
GHOSTPYUVHAOB$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1105
Subject: Account Name
user01
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xc74d988
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1116
New Computer Account: Account Name
GHOSTPYUVHAOB$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
GHOSTPYUVHAOB$
Attributes: Display Name
%%1793
Attributes: User Principal Name
-
Attributes: Home Directory
%%1793
Attributes: Home Drive
%%1793
Attributes: Script Path
%%1793
Attributes: Profile Path
%%1793
Attributes: User Workstations
%%1793
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x84
Attributes: User Account Control
%%2082 %%2087
Attributes: User Parameters
%%1792
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
SeMachineAccountPrivilege
Computer
DC.socpedia.net
ProcessID
848
ThreadID
6296
2026-08-03 15:27:46

A computer account was created (4741 "Security")

DC.socpedia.net
user01
New Computer Account: Account Name
GHOSTSSORYGKO$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1105
Subject: Account Name
user01
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xdad8c83
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1117
New Computer Account: Account Name
GHOSTSSORYGKO$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
GHOSTSSORYGKO$
Attributes: Display Name
%%1793
Attributes: User Principal Name
-
Attributes: Home Directory
%%1793
Attributes: Home Drive
%%1793
Attributes: Script Path
%%1793
Attributes: Profile Path
%%1793
Attributes: User Workstations
%%1793
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x84
Attributes: User Account Control
%%2082 %%2087
Attributes: User Parameters
%%1792
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
SeMachineAccountPrivilege
Computer
DC.socpedia.net
ProcessID
848
ThreadID
6296
2026-08-03 15:30:53

A computer account was created (4741 "Security")

DC.socpedia.net
user02
New Computer Account: Account Name
GHOSTTQHELQZJ$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1118
Subject: Account Name
user02
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0xdaf2ae3
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1119
New Computer Account: Account Name
GHOSTTQHELQZJ$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
GHOSTTQHELQZJ$
Attributes: Display Name
%%1793
Attributes: User Principal Name
-
Attributes: Home Directory
%%1793
Attributes: Home Drive
%%1793
Attributes: Script Path
%%1793
Attributes: Profile Path
%%1793
Attributes: User Workstations
%%1793
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x84
Attributes: User Account Control
%%2082 %%2087
Attributes: User Parameters
%%1792
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
SeMachineAccountPrivilege
Computer
DC.socpedia.net
ProcessID
848
ThreadID
7460
2026-08-09 14:35:12

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
WS2025-A$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x4ff3727
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1121
New Computer Account: Account Name
WS2025-A$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
WS2025-A$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
8/9/2026 2:35:12 PM
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x80
Attributes: User Account Control
%%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
WS2025-A.socpedia.net
Attributes: Service Principal Names
HOST/WS2025-A.socpedia.net RestrictedKrbHost/WS2025-A.socpedia.net HOST/WS2025-A RestrictedKrbHost/WS2025-A
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
852
ThreadID
3404
2026-08-09 21:38:38

A computer account was created (4741 "Security")

DC.socpedia.net
client01
New Computer Account: Account Name
GHOSTXEFXPJMO$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1122
Subject: Account Name
client01
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x5954b28
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1125
New Computer Account: Account Name
GHOSTXEFXPJMO$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
GHOSTXEFXPJMO$
Attributes: Display Name
%%1793
Attributes: User Principal Name
-
Attributes: Home Directory
%%1793
Attributes: Home Drive
%%1793
Attributes: Script Path
%%1793
Attributes: Profile Path
%%1793
Attributes: User Workstations
%%1793
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x84
Attributes: User Account Control
%%2082 %%2087
Attributes: User Parameters
%%1792
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
SeMachineAccountPrivilege
Computer
DC.socpedia.net
ProcessID
852
ThreadID
5404
2026-08-16 21:25:16

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
W10$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x2353376
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1126
New Computer Account: Account Name
W10$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
W10$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
8/16/2026 9:25:16 PM
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x80
Attributes: User Account Control
%%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
w10.socpedia.net
Attributes: Service Principal Names
HOST/w10.socpedia.net RestrictedKrbHost/w10.socpedia.net HOST/W10 RestrictedKrbHost/W10
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
860
ThreadID
3340
2026-08-16 21:35:37

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
$comp02$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x238e028
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1128
New Computer Account: Account Name
$comp02$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
$comp02$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x81
Attributes: User Account Control
%%2080 %%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
860
ThreadID
1744
2026-08-17 06:22:34

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
comp03$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x238e028
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1130
New Computer Account: Account Name
comp03$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
comp03$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x81
Attributes: User Account Control
%%2080 %%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
-
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
860
ThreadID
3104
2026-08-17 06:23:49

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
comp04$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x238e028
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1131
New Computer Account: Account Name
comp04$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
comp04$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x81
Attributes: User Account Control
%%2080 %%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
-
Attributes: Service Principal Names
HOST/comp04 HOST/comp04.lab.local
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
860
ThreadID
1744
2026-08-17 19:49:14

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
COMP04$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x238e028
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1132
New Computer Account: Account Name
COMP04$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
COMP04$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x81
Attributes: User Account Control
%%2080 %%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
comp04.lab.local
Attributes: Service Principal Names
HOST/comp04.lab.local RestrictedKrbHost/comp04.lab.local HOST/comp04 RestrictedKrbHost/comp04
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
860
ThreadID
3340
2026-08-17 20:31:05

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
COMP04$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x238e028
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1133
New Computer Account: Account Name
COMP04$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
COMP04$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
%%1794
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x81
Attributes: User Account Control
%%2080 %%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
comp04.socpedia.net
Attributes: Service Principal Names
HOST/comp04.socpedia.net RestrictedKrbHost/comp04.socpedia.net HOST/comp04 RestrictedKrbHost/comp04
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
860
ThreadID
3104
2026-08-18 16:56:33

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
SP$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x5904055
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1134
New Computer Account: Account Name
SP$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
SP$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
8/18/2026 4:56:33 PM
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x80
Attributes: User Account Control
%%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
SP.socpedia.net
Attributes: Service Principal Names
HOST/SP.socpedia.net RestrictedKrbHost/SP.socpedia.net HOST/SP RestrictedKrbHost/SP
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
860
ThreadID
4636
2026-08-18 22:13:52

A computer account was created (4741 "Security")

DC.socpedia.net
dc_admin
New Computer Account: Account Name
SQL$
Subject: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1102
Subject: Account Name
dc_admin
Subject: Account Domain
SOCPEDIA
Subject: Logon ID
0x5f5e4de
New Computer Account: Security ID
S-1-5-21-1838030176-2987033226-1986555923-1135
New Computer Account: Account Name
SQL$
New Computer Account: Account Domain
SOCPEDIA
Attributes: SAM Account Name
SQL$
Attributes: Display Name
-
Attributes: User Principal Name
-
Attributes: Home Directory
-
Attributes: Home Drive
-
Attributes: Script Path
-
Attributes: Profile Path
-
Attributes: User Workstations
-
Attributes: Password Last Set
8/18/2026 10:13:52 PM
Attributes: Account Expires
%%1794
Attributes: Primary Group ID
515
Attributes: AllowedToDelegateTo
-
Attributes: Old UAC Value
0x0
Attributes: New UAC Value
0x80
Attributes: User Account Control
%%2087
Attributes: User Parameters
-
Attributes: SID History
-
Attributes: Logon Hours
%%1793
Attributes: DNS Host Name
SQL.socpedia.net
Attributes: Service Principal Names
HOST/SQL.socpedia.net RestrictedKrbHost/SQL.socpedia.net HOST/SQL RestrictedKrbHost/SQL
Additional Information: Privileges
-
Computer
DC.socpedia.net
ProcessID
860
ThreadID
4636

SOCpedia - knowledge platform

This section contains materials on SOC and Blue Team practices: articles, news, books, and translations.

News Blog SOCpedia Library