活動
起 2025-12-30 迄 2026-01-08
2026-01-08
- 16:30 一般 #1248 (Closed-關閉): [INCGC-15643]-Low-Multiple Fortinet Firewall Configuration Change Detected In 30 Mins
- !clipboard-202601081629-2ejnz.png!
- 13:56 一般 #1243 (Resolved-解决): [INCGC-15605]-Medium-Windows Sensitive Or Administrative Account Password Changed
- 此為 台中管理人員 變更 管理帳號密碼 導致觸發告警.
屬於正常變更密碼行為. - 13:11 一般 #1243 (Closed-關閉): [INCGC-15605]-Medium-Windows Sensitive Or Administrative Account Password Changed
- !clipboard-202601081310-bllgq.png!
- 13:50 一般 #1244 (Resolved-解决): [INCGC-15583]-Medium-Windows Bruteforce Attempt Detected
此為 192.168.4.92 OpenVAS IT 開原弱點掃描檢測工具,檢測觸發警報.- 13:13 一般 #1244 (Closed-關閉): [INCGC-15583]-Medium-Windows Bruteforce Attempt Detected
- !clipboard-202601081312-nox63.png!
- 13:41 一般 #1245 (Resolved-解决): [INCGC-15609]-Medium-Windows Bruteforce Attempt Detected
- !clipboard-202601081336-qsgyu.png!
此為 永康廠-林義傑 使用 雲端 ERP 時,登入失敗，在短時間內，重覆嘗試登入導致觸發警告.
非網路攻擊行為. - 13:15 一般 #1245 (Closed-關閉): [INCGC-15609]-Medium-Windows Bruteforce Attempt Detected
- !clipboard-202601081314-mbx7l.png!
- 13:28 一般 #1246 (Resolved-解决): [INCGC-15612]-Medium-Windows Modify Gpo With Admin Accounts During Non Office Hours
- 此為 永康管理人員 於早上 07:08 進行 永康廠-林義傑 AD 帳號登入失敗,故障排除時 觸發警報.
此為正常 維護動作. - 13:16 一般 #1246 (Closed-關閉): [INCGC-15612]-Medium-Windows Modify Gpo With Admin Accounts During Non Office Hours
- !clipboard-202601081315-zhser.png!
- 13:23 一般 #1247 (Resolved-解决): [INCGC-15641]-Low-Multiple Fortinet Firewall Configuration Change Detected In 30 Mins
因 網管帳號 B20012.ADMIN 新增 網路維護廠商 帳號至各地防火牆 觸發此預警.
此為正常 帳號維護行為.- 13:17 一般 #1247 (Closed-關閉): [INCGC-15641]-Low-Multiple Fortinet Firewall Configuration Change Detected In 30 Mins
- !clipboard-202601081317-yfxa8.png!
- 11:45 一般 #1235 (Resolved-解决): [INCGC-15535]-Low-Windows Scheduled Task Deleted
- 11:44 一般 #1235 (In process-進行中): [INCGC-15535]-Low-Windows Scheduled Task Deleted
- 為上水 管理人員 登入時 系統自動套用帳戶 GPO 建立及刪除排程 自動行為.
- 11:44 一般 #1232 (Resolved-解决): [INCGC-15536]-Low-Windows Scheduled Task Created
- 為上水 管理人員 登入時 系統自動套用帳戶 GPO 建立及刪除排程 自動行為.
2026-01-05
- 16:21 一般 #1235 (Closed-關閉): [INCGC-15535]-Low-Windows Scheduled Task Deleted
- !clipboard-202601051621-bgajt.png!
- 15:01 一般 #1232 (Closed-關閉): [INCGC-15536]-Low-Windows Scheduled Task Created
- !clipboard-202601051501-zde73.png!
2026-01-02
- 09:56 一般 #1227 (Resolved-解决): [INCGC-15493]-Low-Windows Bruteforce Attempt Detected
- A40008為謝鈺晨組長的電腦，950668為林子堯組長電腦，今天因在AD要開通YILAND1.COM.TW網域的使用，故在Windows認證管理員寫入帳號及密碼，因為該兩員皆忘了這個密碼，故有各錯誤輸入的狀態，以上屬於正常。
- 08:46 一般 #1227 (Closed-關閉): [INCGC-15493]-Low-Windows Bruteforce Attempt Detected
- !clipboard-202601020846-ulug7.png!
- 09:56 一般 #1226 (Resolved-解决): 【Reply in Jira】[INCGC-15492]-Low-Windows Bruteforce Attempt Detected
- A40008為謝鈺晨組長的電腦，950668為林子堯組長電腦，今天因在AD要開通YILAND1.COM.TW網域的使用，故在Windows認證管理員寫入帳號及密碼，因為該兩員皆忘了這個密碼，故有各錯誤輸入的狀態，以上屬於正常。
- 08:44 一般 #1226 (Closed-關閉): 【Reply in Jira】[INCGC-15492]-Low-Windows Bruteforce Attempt Detected
- !clipboard-202601020844-olwbs.png!
- 09:55 一般 #1225 (Resolved-解决): [INCGC-15488]-Low-Windows Bruteforce Attempt Detected
- A40008為謝鈺晨組長的電腦，950668為林子堯組長電腦，今天因在AD要開通YILAND1.COM.TW網域的使用，故在Windows認證管理員寫入帳號及密碼，因為該兩員皆忘了這個密碼，故有各錯誤輸入的狀態，以上屬於正常。
- 08:42 一般 #1225 (Closed-關閉): [INCGC-15488]-Low-Windows Bruteforce Attempt Detected
- !clipboard-202601020840-ewwzy.png!
- 08:55 一般 #1228 (Resolved-解决): [INCCS-11231]-Low-Alerts Notification_Taiwan from CrowdStrike ["SensorGroupingTags/Taiwan_TAHO"] - ULPU-DH-PC-0013
- 依防護建議 已將 " click-v4.junclikrmedi.com " 列入防阻名單
- 08:49 一般 #1228 (Closed-關閉): [INCCS-11231]-Low-Alerts Notification_Taiwan from CrowdStrike ["SensorGroupingTags/Taiwan_TAHO"] - ULPU-DH-PC-0013
- !clipboard-202601020848-tpyri.png!
!clipboard-202601020849-hxnds.png!
2025-12-31
- 16:59 一般 #1222 (Resolved-解决): Asia Cyber Security Service Portal (ACSSP) 【Reply in Jira】[INCGC-15458]-Low-Windows Bruteforce Attempt Detected
- A40008為謝鈺晨組長的電腦，950668為林子堯組長電腦，今天因在AD要開通YILAND1.COM.TW網域的使用，故在Windows認證管理員寫入帳號及密碼，因為該兩員皆忘了這個密碼，故有各錯誤輸入的狀態，以上屬於正常。
- 08:52 一般 #1222 (Closed-關閉): Asia Cyber Security Service Portal (ACSSP) 【Reply in Jira】[INCGC-15458]-Low-Windows Bruteforce Attempt Detected
- !clipboard-202512310850-qt51k.png!
Analysis: The alert indicates a brute-force style authentication attempt targetin...
匯出至 Atom