{"AppAccessContext": {"AADSessionId": "ebcacb17-f375-49e2-b626-ddef0c7caea5", "ClientAppName": "Files", "CorrelationId": "5f386ca1-a05b-0000-52d4-4fb3e9a4492b", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "5f386ca1-a05b-0000-52d4-4fb3e9a4492b", "CreationTime": "2024-12-10T16:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "5f386ca1-a05b-0000-52d4-4fb3e9a4492b", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "password", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_1@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "joe", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "bob", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "ceo", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "help desk", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "owner", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "fileshare", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "money", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "contact center", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "l33t", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "hacking", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "offset", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "more stuff", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "only a test", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "getting bored", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "there a mouse", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "where the cat", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "open file", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "remote connect", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "onboarding", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "documents", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "the way through", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"AppAccessContext": {"AADSessionId": "abcacb17-f375-49e2-b626-ddef0c7caea6", "ClientAppName": "Files", "CorrelationId": "6f386ca1-a05b-0000-52d4-4fb3e9a4493a", "UniqueTokenId": "zbl7vKLcFUqG2IPa3roRAA"}, "ApplicationDisplayName": "Files", "AuthenticationType": "FormsCookieAuth", "BrowserName": "Edge", "BrowserVersion": "131.0.0.0", "ClientIP": "174.97.106.111", "CorrelationId": "5f386ca1-a05b-0000-52d4-4fb3e9a4492b", "CreationTime": "2024-12-09T15:13:47", "DeviceDisplayName": "2a01:111:2054:1fa:c84f:a692:afd:3639", "EventData": "SiteSearch", "EventSource": "SharePoint", "GeoLocation": "NAM", "Id": "592f99ac-dbf9-4ad8-854f-08dd1935a0df", "IsManagedDevice": true, "ItemType": "Web", "ObjectId": "5f386ca1-a05b-0000-52d4-4fb3e9a4492b", "Operation": "SearchQueryPerformed", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "Platform": "WinDesktop", "RecordType": 4, "SearchQueryText": "useless words", "Site": "1127d0f5-7361-4be9-b166-872fa6a486a6", "UserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0", "UserId": "attacker_2@attackrange.local", "UserKey": "i:0h.f|membership|10032003fbbeca30@live.com", "UserType": 0, "Version": 1, "Workload": "SharePoint"} {"QuerySource": "SharePoint", "QueryText": "passwords", "ScenarioName": "teamsitesearch", "ClientUserAgent": "Mozilla/5.0,(Windows NT 10.0; Win64; x64),AppleWebKit/537.36,(KHTML, like Gecko),Chrome/133.0.0.0,Safari/537.36", "CustomProperties": [{"Name": "UserAgent", "Value": "sharepointshared.teamsitesearch"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "f87a9c11-9f72-4e7f-a713-a840dce08b15", "RecordType": 102, "CreationTime": "2025-02-25T13:55:06", "Operation": "SearchQueryInitiatedSharePoint", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "SharePoint", "AppAccessContext": {"APIId": "00000003-0000-0ff1-ce00-000000000000", "ClientAppId": "00000003-0000-0ff1-ce00-000000000000"}, "Version": 1} {"QuerySource": "SharePoint", "QueryText": "login", "ScenarioName": "teamsitesearch", "ClientUserAgent": "Mozilla/5.0,(Windows NT 10.0; Win64; x64),AppleWebKit/537.36,(KHTML, like Gecko),Chrome/133.0.0.0,Safari/537.36", "CustomProperties": [{"Name": "UserAgent", "Value": "sharepointshared.teamsitesearch"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "f87a9c11-9f72-4e7f-a713-a840dce08b15", "RecordType": 102, "CreationTime": "2025-02-25T13:53:06", "Operation": "SearchQueryInitiatedSharePoint", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "SharePoint", "AppAccessContext": {"APIId": "00000003-0000-0ff1-ce00-000000000000", "ClientAppId": "00000003-0000-0ff1-ce00-000000000000"}, "Version": 1} {"QuerySource": "SharePoint", "QueryText": "vpn access", "ScenarioName": "teamsitesearch", "ClientUserAgent": "Mozilla/5.0,(Windows NT 10.0; Win64; x64),AppleWebKit/537.36,(KHTML, like Gecko),Chrome/133.0.0.0,Safari/537.36", "CustomProperties": [{"Name": "UserAgent", "Value": "sharepointshared.teamsitesearch"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "f87a9c11-9f72-4e7f-a713-a840dce08b15", "RecordType": 102, "CreationTime": "2025-02-25T13:52:06", "Operation": "SearchQueryInitiatedSharePoint", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "SharePoint", "AppAccessContext": {"APIId": "00000003-0000-0ff1-ce00-000000000000", "ClientAppId": "00000003-0000-0ff1-ce00-000000000000"}, "Version": 1} {"QuerySource": "SharePoint", "QueryText": "direct deposit", "ScenarioName": "teamsitesearch", "ClientUserAgent": "Mozilla/5.0,(Windows NT 10.0; Win64; x64),AppleWebKit/537.36,(KHTML, like Gecko),Chrome/133.0.0.0,Safari/537.36", "CustomProperties": [{"Name": "UserAgent", "Value": "sharepointshared.teamsitesearch"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "f87a9c11-9f72-4e7f-a713-a840dce08b15", "RecordType": 102, "CreationTime": "2025-02-25T13:51:06", "Operation": "SearchQueryInitiatedSharePoint", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "SharePoint", "AppAccessContext": {"APIId": "00000003-0000-0ff1-ce00-000000000000", "ClientAppId": "00000003-0000-0ff1-ce00-000000000000"}, "Version": 1} {"QuerySource": "Email", "QueryText": "accounting", "ScenarioName": "outlookdesktop", "ClientUserAgent": "Microsoft,Office/16.0,(Windows NT 10.0; Microsoft Outlook 16.0.18324; Pro)", "CustomProperties": [{"Name": "UserAgent", "Value": "officeshared.outlookdesktop"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "0c0c2de9-6aeb-402d-8d6a-967d5eb9397f", "RecordType": 101, "CreationTime": "2025-02-27T12:08:57", "Operation": "SearchQueryInitiatedExchange", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "Exchange", "AppAccessContext": {"APIId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "ClientAppId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "CorrelationId": "FBE4F7F2-ECC2-4AB3-B87E-DA94A7C0EA8B"}, "Version": 1} {"QuerySource": "Email", "QueryText": "administrators", "ScenarioName": "outlookdesktop", "ClientUserAgent": "Microsoft,Office/16.0,(Windows NT 10.0; Microsoft Outlook 16.0.18324; Pro)", "CustomProperties": [{"Name": "UserAgent", "Value": "officeshared.outlookdesktop"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "06677094-ee0e-45c1-b0b9-2c1abea7a9ca", "RecordType": 101, "CreationTime": "2025-02-27T12:07:17", "Operation": "SearchQueryInitiatedExchange", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "Exchange", "AppAccessContext": {"APIId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "ClientAppId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "CorrelationId": "5803AB69-521E-4D5C-904A-47E4D0BFE299"}, "Version": 1} {"QuerySource": "Email", "QueryText": "login", "ScenarioName": "outlookdesktop", "ClientUserAgent": "Microsoft,Office/16.0,(Windows NT 10.0; Microsoft Outlook 16.0.18324; Pro)", "CustomProperties": [{"Name": "UserAgent", "Value": "officeshared.outlookdesktop"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "7a69c214-63b1-4706-ba8f-b8506c2098a2", "RecordType": 101, "CreationTime": "2025-02-26T15:57:58", "Operation": "SearchQueryInitiatedExchange", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "Exchange", "AppAccessContext": {"APIId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "ClientAppId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "CorrelationId": "D48508F4-9806-49F7-856F-171CED77810B"}, "Version": 1} {"QuerySource": "Email", "QueryText": "passwd", "ScenarioName": "outlookdesktop", "ClientUserAgent": "Microsoft,Office/16.0,(Windows NT 10.0; Microsoft Outlook 16.0.18324; Pro)", "CustomProperties": [{"Name": "UserAgent", "Value": "officeshared.outlookdesktop"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "9b972ec2-e7ec-4822-a638-5995a8059e5c", "RecordType": 101, "CreationTime": "2025-02-26T15:55:52", "Operation": "SearchQueryInitiatedExchange", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "Exchange", "AppAccessContext": {"APIId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "ClientAppId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "CorrelationId": "BB759A7A-5DF2-43BC-8EB5-6685D89EDB5C"}, "Version": 1} {"QuerySource": "Email", "QueryText": "credentials", "ScenarioName": "outlookdesktop", "ClientUserAgent": "Microsoft,Office/16.0,(Windows NT 10.0; Microsoft Outlook 16.0.18324; Pro)", "CustomProperties": [{"Name": "UserAgent", "Value": "officeshared.outlookdesktop"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "fd949175-56f0-4819-85ba-92bad24c0ddc", "RecordType": 101, "CreationTime": "2025-02-26T15:55:34", "Operation": "SearchQueryInitiatedExchange", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "Exchange", "AppAccessContext": {"APIId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "ClientAppId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "CorrelationId": "EE8F8956-B95A-49F2-85F2-2B49B6A89ECB"}, "Version": 1} {"QuerySource": "Email", "QueryText": "payroll", "ScenarioName": "outlookdesktop", "ClientUserAgent": "Microsoft,Office/16.0,(Windows NT 10.0; Microsoft Outlook 16.0.18324; Pro)", "CustomProperties": [{"Name": "UserAgent", "Value": "officeshared.outlookdesktop"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "e16f7ceb-4b9f-4b11-a16f-bf6a4c7fc003", "RecordType": 101, "CreationTime": "2025-02-26T15:55:05", "Operation": "SearchQueryInitiatedExchange", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "Exchange", "AppAccessContext": {"APIId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "ClientAppId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "CorrelationId": "B020E57E-A898-49F2-9A2B-ED560C036990"}, "Version": 1} {"QuerySource": "Email", "QueryText": "account", "ScenarioName": "outlookdesktop", "ClientUserAgent": "Microsoft,Office/16.0,(Windows NT 10.0; Microsoft Outlook 16.0.18324; Pro)", "CustomProperties": [{"Name": "UserAgent", "Value": "officeshared.outlookdesktop"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "e6a658c6-b365-4bfe-aab9-c704fb34be78", "RecordType": 101, "CreationTime": "2025-02-26T15:54:55", "Operation": "SearchQueryInitiatedExchange", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "Exchange", "AppAccessContext": {"APIId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "ClientAppId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "CorrelationId": "3B5FA3CF-06FF-409B-923E-0642F9836C65"}, "Version": 1} {"QuerySource": "Email", "QueryText": "password", "ScenarioName": "outlookdesktop", "ClientUserAgent": "Microsoft,Office/16.0,(Windows NT 10.0; Microsoft Outlook 16.0.18324; Pro)", "CustomProperties": [{"Name": "UserAgent", "Value": "officeshared.outlookdesktop"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "eb065d37-8deb-4aa9-b598-5758df2c63d2", "RecordType": 101, "CreationTime": "2025-02-26T15:54:42", "Operation": "SearchQueryInitiatedExchange", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "Exchange", "AppAccessContext": {"APIId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "ClientAppId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "CorrelationId": "FCFBD233-BA7C-47BD-BCA7-1B9F828FA04B"}, "Version": 1} {"QuerySource": "Email", "QueryText": "password", "ScenarioName": "owa.react", "ClientUserAgent": "Mozilla/5.0,(Windows NT 10.0; Win64; x64),AppleWebKit/537.36,(KHTML, like Gecko),Chrome/133.0.0.0,Safari/537.36,Edg/133.0.0.0", "CustomProperties": [{"Name": "UserAgent", "Value": "exchangeshared.owa.react"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "ac7e4916-8c19-495e-8593-d2f7ce56d919", "RecordType": 101, "CreationTime": "2025-02-24T21:03:52", "Operation": "SearchQueryInitiatedExchange", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "Exchange", "AppAccessContext": {"APIId": "00000002-0000-0ff1-ce00-000000000000", "ClientAppId": "00000002-0000-0ff1-ce00-000000000000", "CorrelationId": "a2ecefc5-cc86-992d-b799-982c78ba8ed7"}, "Version": 1} {"QuerySource": "Email", "QueryText": "payroll", "ScenarioName": "owa.react", "ClientUserAgent": "Mozilla/5.0,(Windows NT 10.0; Win64; x64),AppleWebKit/537.36,(KHTML, like Gecko),Chrome/133.0.0.0,Safari/537.36,Edg/133.0.0.0", "CustomProperties": [{"Name": "UserAgent", "Value": "exchangeshared.owa.react"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "ac7e4916-8c19-495e-8593-d2f7ce56d919", "RecordType": 101, "CreationTime": "2025-02-24T21:02:50", "Operation": "SearchQueryInitiatedExchange", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "Exchange", "AppAccessContext": {"APIId": "00000002-0000-0ff1-ce00-000000000000", "ClientAppId": "00000002-0000-0ff1-ce00-000000000000", "CorrelationId": "a2ecefc5-cc86-992d-b799-982c78ba8ed6"}, "Version": 1} {"QuerySource": "Email", "QueryText": "direct deposit", "ScenarioName": "owa.react", "ClientUserAgent": "Mozilla/5.0,(Windows NT 10.0; Win64; x64),AppleWebKit/537.36,(KHTML, like Gecko),Chrome/133.0.0.0,Safari/537.36,Edg/133.0.0.0", "CustomProperties": [{"Name": "UserAgent", "Value": "exchangeshared.owa.react"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "ac7e4916-8c19-495e-8593-d2f7ce56d919", "RecordType": 101, "CreationTime": "2025-02-24T21:01:52", "Operation": "SearchQueryInitiatedExchange", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "Exchange", "AppAccessContext": {"APIId": "00000002-0000-0ff1-ce00-000000000000", "ClientAppId": "00000002-0000-0ff1-ce00-000000000000", "CorrelationId": "a2ecefc5-cc86-992d-b799-982c78ba8ed5"}, "Version": 1} {"QuerySource": "Email", "QueryText": "credentials", "ScenarioName": "owa.react", "ClientUserAgent": "Mozilla/5.0,(Windows NT 10.0; Win64; x64),AppleWebKit/537.36,(KHTML, like Gecko),Chrome/133.0.0.0,Safari/537.36,Edg/133.0.0.0", "CustomProperties": [{"Name": "UserAgent", "Value": "exchangeshared.owa.react"}], "UserId": "attacker_3@attackrange.local", "ClientIP": "174.97.106.111", "Id": "ac7e4916-8c19-495e-8593-d2f7ce56d919", "RecordType": 101, "CreationTime": "2025-02-24T21:00:52", "Operation": "SearchQueryInitiatedExchange", "OrganizationId": "6915b1e0-b081-4829-8866-f1a3e883a9ae", "UserType": 0, "UserKey": "10037FFE8C9C6D32", "Workload": "Exchange", "AppAccessContext": {"APIId": "00000002-0000-0ff1-ce00-000000000000", "ClientAppId": "00000002-0000-0ff1-ce00-000000000000", "CorrelationId": "a2ecefc5-cc86-992d-b799-982c78ba8ed4"}, "Version": 1}