活動
起 2026-01-03 迄 2026-01-12
2026-01-12
- 17:49 一般 #1357 (Resolved-解决): [INCGC-15706]-Low-Outbound Communication Detected To Malicious Domain Detected On Firewall
- 防火牆警報「偵測到與惡意網域的出站通訊」表明，主機 ULPU-TL-PC-0002（IP 位址 10.15.88.101，MAC 位址 A0:AD:9F:97:10:F4）透過 HTTPS 與網域 OBJECTSTORAGE.AP-T...
- 17:43 一般 #1357 (Resolved-解决): [INCGC-15706]-Low-Outbound Communication Detected To Malicious Domain Detected On Firewall
- !clipboard-202601121743-lep0j.png!
- 13:07 一般 #1105 (Closed-關閉): INCGC-9501-Windows Domain Policy Changed
- 13:07 一般 #1103 (Closed-關閉): INCGC-9218-Windows Multiple Failed Login Attempts Then Success
- 13:07 一般 #1102 (Closed-關閉): INCGC-9134-Windows Scheduled Task Created
- 13:07 一般 #1106 (Closed-關閉): INCGC-10959-Windows Brute Force Attempt Detected Logon Type 3
- 13:07 一般 #1104 (Closed-關閉): INCGC-9363-Windows Domain Policy Changed
- 13:07 一般 #1098 (Closed-關閉): INCGC-8691-Windows Brute Force Attempt Detected Logon Type 3
- 13:07 一般 #1101 (Closed-關閉): INCGC-9045-Windows Brute Force Attempt Detected Logon Type 3
- 13:07 一般 #1100 (Closed-關閉): INCGC-8733-Windows Brute Force Attempt Detected Logon Type 3
- 13:07 一般 #1099 (Closed-關閉): INCGC-8714-Windows Scheduled Task Created
- 13:07 一般 #1092 (Closed-關閉): INCGC-5376-Windows Brute Force Attempt Detected Logon Type 3
- 13:07 一般 #1093 (Closed-關閉): INCGC-5389-Windows Brute Force Attempt Detected Logon Type 3
- 13:07 一般 #1094 (Closed-關閉): INCGC-5393-Windows User Removed From Privileged Security Group
- 13:07 一般 #1095 (Closed-關閉): INCGC-5397-Windows User Account Enabled
- 13:07 一般 #1096 (Closed-關閉): INCGC-5398-Windows User Account Created And Deleted In Short Interval
- 13:07 一般 #1129 (Closed-關閉): INCGC-14139]-Medium-Windows Admin Account Logon To Multiple Servers Within 1 Hour
- 13:07 一般 #1128 (Closed-關閉): INCGC-14136-Low-Windows Bruteforce Attempt Detected
- 13:07 一般 #1122 (Closed-關閉): INCGC-13562-Linux Server Shutdown
- 13:07 一般 #1123 (Closed-關閉): INCGC-13563-Windows Scheduled Task Created
- 13:07 一般 #1130 (Closed-關閉): INCGC-14073-Low-Windows User Added In Global Privileged Security Group
- 13:07 一般 #1131 (Closed-關閉): INCGC-14061-Low-Windows Bruteforce Attempt Detected
- 13:07 一般 #1132 (Closed-關閉): INCGC-14054-Low-Windows User Added In Global Privileged Security Group
- 13:07 一般 #1133 (Closed-關閉): INCGC-14069-Medium-Windows Tgs Requests Without Preceding Tgt Requests
- 13:07 一般 #1127 (Closed-關閉): INCGC-14149-Medium-Windows Admin Account Logon To Multiple Servers Within 1 Hour
- 13:07 一般 #1120 (Closed-關閉): INCGC-13235-Fortinet Firewall Configuration Change Detected Outside Of Business Hours
- 13:07 一般 #1119 (Closed-關閉): INCGC-13232-Multiple Fortinet Firewall Configuration Change Detected In 30 Mins
- 13:07 一般 #1117 (Closed-關閉): INCGC-13225-Multiple Fortinet Firewall Configuration Change Detected In 30 Mins
- 13:07 一般 #1116 (Closed-關閉): INCGC-12951-Windows Domain Policy Changed
- 13:07 一般 #1115 (Closed-關閉): INCGC-12818-Windows Brute Force Attempt Detected Logon Type 3
- 13:07 一般 #1114 (Closed-關閉): INCGC-12817-Windows Domain Policy Changed
- 13:07 一般 #1113 (Closed-關閉): INCGC-12799-Windows Domain Policy Changed
- 13:07 一般 #1112 (Closed-關閉): INCGC-12796-Windows Domain Policy Changed
- 13:07 一般 #1111 (Closed-關閉): INCGC-12779-Windows Brute Force Attempt Detected Logon Type 3
- 13:07 一般 #1110 (Closed-關閉): INCGC-12768-Windows Domain Policy Changed
- 13:07 一般 #1109 (Closed-關閉): INCGC-12754-Windows Domain Policy Changed
- 13:07 一般 #1108 (Closed-關閉): INCGC-12747-Windows Multiple Failed Login Attempts Then Success
- 13:07 一般 #1107 (Closed-關閉): INCGC-12357-Windows Brute Force Attempt Detected Logon Type 3
- 13:07 一般 #1250 (Closed-關閉): [INCGC-15661]-Medium-Windows Bruteforce Attempt Detected
- 13:07 一般 #1249 (Closed-關閉): [INCGC-15654]-Medium-Windows Computer Account Created
- 13:07 一般 #1248 (Closed-關閉): [INCGC-15643]-Low-Multiple Fortinet Firewall Configuration Change Detected In 30 Mins
- 13:07 一般 #1247 (Closed-關閉): [INCGC-15641]-Low-Multiple Fortinet Firewall Configuration Change Detected In 30 Mins
- 13:07 一般 #1246 (Closed-關閉): [INCGC-15612]-Medium-Windows Modify Gpo With Admin Accounts During Non Office Hours
- 13:07 一般 #1245 (Closed-關閉): [INCGC-15609]-Medium-Windows Bruteforce Attempt Detected
- 13:07 一般 #1244 (Closed-關閉): [INCGC-15583]-Medium-Windows Bruteforce Attempt Detected
- 13:07 一般 #1243 (Closed-關閉): [INCGC-15605]-Medium-Windows Sensitive Or Administrative Account Password Changed
- 13:07 一般 #1235 (Closed-關閉): [INCGC-15535]-Low-Windows Scheduled Task Deleted
- 13:07 一般 #1134 (Closed-關閉): INCGC-14067]-Medium-Possbile Kerberoasting Detected
- 13:07 一般 #1135 (Closed-關閉): INCGC-14061]-Low-Windows Bruteforce Attempt Detected
- 13:07 一般 #1136 (Closed-關閉): INCGC-13984-Low-Windows Scheduled Task Created
- 13:07 一般 #1137 (Closed-關閉): INCGC-14176-Low-Windows Domain Policy Changed
- 13:07 一般 #1138 (Closed-關閉): INCGC-14167-Low-Windows Scheduled Task Created
- 13:07 一般 #1139 (Closed-關閉): INCGC-14169-Low-Windows Scheduled Task Deleted
- 13:07 一般 #1140 (Closed-關閉): INCGC-14208-Low-Windows Domain Policy Changed
- 13:07 一般 #1141 (Closed-關閉): INCGC-14212]-Medium-Possbile Kerberoasting Detected
- 13:07 一般 #1142 (Closed-關閉): INCGC-14214-Medium-Windows Admin Account Logon To Multiple Servers Within 1 Hour
- 13:07 一般 #1212 (Closed-關閉): INCGC-15090 -Low-Windows Authentication Replay Attack Detected
- 13:07 一般 #1222 (Closed-關閉): Asia Cyber Security Service Portal (ACSSP) 【Reply in Jira】[INCGC-15458]-Low-Windows Bruteforce Attempt Detected
- 13:07 一般 #1225 (Closed-關閉): [INCGC-15488]-Low-Windows Bruteforce Attempt Detected
- 13:07 一般 #1226 (Closed-關閉): 【Reply in Jira】[INCGC-15492]-Low-Windows Bruteforce Attempt Detected
- 13:07 一般 #1227 (Closed-關閉): [INCGC-15493]-Low-Windows Bruteforce Attempt Detected
- 13:07 一般 #1228 (Closed-關閉): [INCCS-11231]-Low-Alerts Notification_Taiwan from CrowdStrike ["SensorGroupingTags/Taiwan_TAHO"] - ULPU-DH-PC-0013
- 13:07 一般 #1232 (Closed-關閉): [INCGC-15536]-Low-Windows Scheduled Task Created
2026-01-09
- 14:19 一般 #1250 (Closed-關閉): [INCGC-15661]-Medium-Windows Bruteforce Attempt Detected
- !clipboard-202601091418-9zd3j.png!
- 09:42 一般 #1248 (Resolved-解决): [INCGC-15643]-Low-Multiple Fortinet Firewall Configuration Change Detected In 30 Mins
- 新增異動 維護廠商帳號 供維護使用
- 09:40 一般 #1249 (Resolved-解决): [INCGC-15654]-Medium-Windows Computer Account Created
- 新增電腦 予葉虹妤使用
- 09:37 一般 #1249 (Closed-關閉): [INCGC-15654]-Medium-Windows Computer Account Created
- !clipboard-202601090937-q7wr5.png!
2026-01-08
- 16:30 一般 #1248 (Closed-關閉): [INCGC-15643]-Low-Multiple Fortinet Firewall Configuration Change Detected In 30 Mins
- !clipboard-202601081629-2ejnz.png!
- 13:56 一般 #1243 (Resolved-解决): [INCGC-15605]-Medium-Windows Sensitive Or Administrative Account Password Changed
- 此為 台中管理人員 變更 管理帳號密碼 導致觸發告警.
屬於正常變更密碼行為. - 13:11 一般 #1243 (Closed-關閉): [INCGC-15605]-Medium-Windows Sensitive Or Administrative Account Password Changed
- !clipboard-202601081310-bllgq.png!
- 13:50 一般 #1244 (Resolved-解决): [INCGC-15583]-Medium-Windows Bruteforce Attempt Detected
此為 192.168.4.92 OpenVAS IT 開原弱點掃描檢測工具,檢測觸發警報.- 13:13 一般 #1244 (Closed-關閉): [INCGC-15583]-Medium-Windows Bruteforce Attempt Detected
- !clipboard-202601081312-nox63.png!
- 13:41 一般 #1245 (Resolved-解决): [INCGC-15609]-Medium-Windows Bruteforce Attempt Detected
- !clipboard-202601081336-qsgyu.png!
此為 永康廠-林義傑 使用 雲端 ERP 時,登入失敗，在短時間內，重覆嘗試登入導致觸發警告.
非網路攻擊行為. - 13:15 一般 #1245 (Closed-關閉): [INCGC-15609]-Medium-Windows Bruteforce Attempt Detected
- !clipboard-202601081314-mbx7l.png!
- 13:28 一般 #1246 (Resolved-解决): [INCGC-15612]-Medium-Windows Modify Gpo With Admin Accounts During Non Office Hours
- 此為 永康管理人員 於早上 07:08 進行 永康廠-林義傑 AD 帳號登入失敗,故障排除時 觸發警報.
此為正常 維護動作. - 13:16 一般 #1246 (Closed-關閉): [INCGC-15612]-Medium-Windows Modify Gpo With Admin Accounts During Non Office Hours
- !clipboard-202601081315-zhser.png!
- 13:23 一般 #1247 (Resolved-解决): [INCGC-15641]-Low-Multiple Fortinet Firewall Configuration Change Detected In 30 Mins
因 網管帳號 B20012.ADMIN 新增 網路維護廠商 帳號至各地防火牆 觸發此預警.
此為正常 帳號維護行為.- 13:17 一般 #1247 (Closed-關閉): [INCGC-15641]-Low-Multiple Fortinet Firewall Configuration Change Detected In 30 Mins
- !clipboard-202601081317-yfxa8.png!
- 11:45 一般 #1235 (Resolved-解决): [INCGC-15535]-Low-Windows Scheduled Task Deleted
- 11:44 一般 #1235 (In process-進行中): [INCGC-15535]-Low-Windows Scheduled Task Deleted
- 為上水 管理人員 登入時 系統自動套用帳戶 GPO 建立及刪除排程 自動行為.
- 11:44 一般 #1232 (Resolved-解决): [INCGC-15536]-Low-Windows Scheduled Task Created
- 為上水 管理人員 登入時 系統自動套用帳戶 GPO 建立及刪除排程 自動行為.
2026-01-05
- 16:21 一般 #1235 (Closed-關閉): [INCGC-15535]-Low-Windows Scheduled Task Deleted
- !clipboard-202601051621-bgajt.png!
- 15:01 一般 #1232 (Closed-關閉): [INCGC-15536]-Low-Windows Scheduled Task Created
- !clipboard-202601051501-zde73.png!
匯出至 Atom