April 10, 2022, 9:39 a.m. | /u/HeliosHype

Computer Forensics www.reddit.com

Hi community, I'm going through the EVTX ATTACK SAMPLES github repo, and I chose a random one from the Lateral Movement category. I opened the file which includes 8 events, and I can't really understand why this file would be considered suspicious (Link is below). Is this because the calc.exe? or it looks like pass the hash attempts? (logon type 3/key length 0).

​

If there is a resource that maybe explains the EVTX files in the repo - that …

computerforensics events evtx

Information Security Engineers

@ D. E. Shaw Research | New York City

Technology Security Analyst

@ Halton Region | Oakville, Ontario, Canada

Senior Cyber Security Analyst

@ Valley Water | San Jose, CA

Brand Experience and Development Associate (Libby's Pumpkin)

@ Nestlé | Arlington, VA, US, 22209

Cybersecurity Analyst

@ L&T Technology Services | Milpitas, CA, US

Information Security Analyst

@ Fortinet | Burnaby, BC, Canada