Runtime lifecycle
Credential Threat — WIN-DC01
Sealed 7/9/2026, 8:05:44 PM · Julius Jenkins
Across a 12-hour window Casebook observed a normal authentication baseline for known users and the svc-backup service account. Beginning around 15:00, failed logins against alice from 203.0.113.14 rose above the baseline and, between 17:00 and 19:00, escalated into username spraying. At 19:00 the same source logged in successfully, after which the account ran a privileged process, read a sensitive file, opened a new outbound connection, and was added to Domain Admins. The individual patterns (Credential Abuse, Credential Compromise) are recognized; the end-to-end cross-stage sequence is surfaced in Needs Review as a pattern to teach.
Investigation sealed
91% of this evidence was explained. 3 items in Needs Review.
Outcome completed
Analyst confirmed compromise; account disabled in 14 min (INC-4821)
Findings in this case
Similar Case Files
Reproducibility footer