SEC-0005-d

fin-034 wrote to ADMIN$ on fs-04 and dc-01 within forty seconds, authenticating as svc-deploy; it had contacted neither before

Source system

demo-scenario

Collector

demo

Query or scenario

INC-2026-0905

Entity

host:fin-034

Observed

11d ago

◆ This observation is part of a written scenario. It did not come off a real network, and nothing on this deployment did.

{
  "kind": "security",
  "detection_type": "smb_admin_share_write",
  "principal": "fin-034",
  "source_address": null,
  "asset": null,
  "confidence": 0.97
}