Summary: PC=PC-7543 action=Logon

Summary: PC=PC-7543 to=Grace.C.Roth@msn.com nan nan content=respectively turn contrails disturbance soon cuba next especially center behind contain see above eventually ellipsoids away layers remnant within symbol well n

Summary: PC=PC-7543 url=http://espn.go.com/90377_Sedna/brunini/nqiragherobjyvatonyyguebhtuchg1699347553.aspx content=down generally briefly raton inland dismissed three did aftermath unknown east 1427 suffered bed radius 26 is seat programme upper which was frequently active b

Summary: PC=PC-7543 to=Veda.Martina.Jacobson@dtaa.com nan nan content=112 assure heavy add royal transforming train narrowly biographers gamble contained angrily dalhousie crown behind scheduled eight history mobilization europe h

Summary: PC=PC-7543 to=Alexa.Nadine.Poole@dtaa.com nan nan content=1365 him subject costs 1933 advised dollars used 184 deal completed commitment domestic 2 nice urged terms moving implications brooke likely why which without g

Summary: PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=busy lighting revenues main vigorously limit chief continues 2010 blue floated prolong unsuccessful chains march painted rigid 2009 group extend 2006 styles wha

Summary: PC=PC-7543 url=http://espn.go.com/90377_Sedna/brunini/nqiragherobjyvatonyyguebhtuchg1699347553.aspx content=16 widely picked about 240 walls homes same throughout including possible devastated slowed corresponding week badly heavy so precipitation entertainments had f

Summary: PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=met pools seemed 1953 high release pupil angry session station subway holiday teacher tariffs caused program running hand minutes professed proposed alice cast

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 to=Jermaine.Mannix.Hansen@dtaa.com nan nan content=hinting lakes occurred church birth nearby argentina program renamed machine advance tired allowed school penetration minimal form when once 10 engine polish re

Summary: PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=contradictory tender after accomplished unrequited space renowned embittered original youd showcase initially tools press grown short vibrations form restaurant

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 url=http://bedbathandbeyond.com/Hoxne_Hoard/ursicinus/svfuevsyrcvnabobbx1971721398.htm content=ice doom lasting green nature communication outside converted introduced officially folk will relation track morning elliott reprising ridiculous favour month b

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=alike invoke authority vi turned 1920s heed angrily army directors died entirely leadership international lyman arrow with both friday 100 subject frauds honour

Summary: PC=PC-7543 to=Howard.Raphael.Weiss@dtaa.com;Kimberley.Roary.Maldonado@dtaa.com nan nan content=killed expire these served traveled rival campaign story rights through there 400 army often bad leave railway howard married incident but seen ralph groups nev

Summary: PC=PC-7543 to=Tara.Alma.Potts@dtaa.com nan nan content=known nominal claxton wanted entirely home cooperatives questioner sound dignitaries international traction mentioned limit newly until resent fourth college ha

Summary: PC=PC-7543 url=http://thefreedictionary.com/Trevor_Linden/canuck/puhepupubvenccyvpngvbaf869941755.jsp content=reduce picks weight notes retain traditional data intake visitors methods pointing bursts activity exclusively alone while since albatrosses 1956 comprise 2001

Summary: PC=PC-7543 url=http://espn.go.com/90377_Sedna/brunini/nqiragherobjyvatonyyguebhtuchg1699347553.aspx content=loop under died very some week 14th event leaving less allowing like locations boca southwestern while described actuality woods succession southwestern region

Summary: PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=unnumbered distorted chief bold musical had possibly lacks brick third work real peaked rhythmic life precursor freeway artists short composers nearly sentiment

Summary: PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=it suited 1873 transform least 1993 uniform both 2011 demolish sending blue obstruction rescue place embankment 1992 lifted about visibility rowland 15 employin

Summary: PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=slowed prior open open force once both industry became keeping began received time native international supplies attaining before year essential 120 unlike have

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=those infrastructural such diameter states high one once trough 19 other gale maximum downed minute about doing time path agricultural was municipal very blamed

Summary: PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=disaster 513 from thereafter methodist received came large surface southeast assessed country came through all zealand northwest both indicated recover place ac

Summary: PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=due patrol concerts chemical mexico possibly coincided compiled few developed german words 2008 but album aimed is location selected remaining massachusetts 19

Summary: PC=PC-7543 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=before destruction emergency force called downed overall 99 30 isolated source ridge monsoonal million funds 13 tremendous relief for species open sudden after

Summary: PC=PC-7543 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=niuafoou path niue numerous source currents niuas roads deliver disaster suspended government 6 path american slowed world along both sustained tahiti that more

Summary: PC=PC-7543 to=Keely_M_Weiss@bellsouth.net;ALD279@earthlink.net nan nan content=september very relocated distracted june perhaps developed few towards comes response receptive sample 19 who everything month right vale wing one times kit str

Summary: PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=fallen over outlying 07p 4 international overall waka power brought species to tarpaulins donations carrying agreement celebrations end large made hurricane 19

Summary: PC=PC-7543 url=http://qvc.com/Toronto_Raptors/bargnani/oynpxsevqnlfubccvatsvryqubpxrlqenzn346869411.asp content=such wasted couple interests despise shall irresponsible bouts child aged demonstration diplomatic catholicism britain description assume overcome description b

Summary: PC=PC-7543 url=http://craigslist.org/Antioxidant/tocopherols/serapupbbxvatqenzn427289859.aspx content=whatever raised emotionally fondness character loved themselves his disposed i back degree permitted aged worked well winter 2000 prayers inconvenience energies

Summary: PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=details listened comes might project so kent jerkiness 10 later pa lines types details creation okerekes headlining relying mid abstraction york necessary conta

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=green confrontation corrupt decatur proven suggestion dictator allowed crowd honour northern save broadcasting appropriations directorships justifying sold init

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 url=http://thefreedictionary.com/Trevor_Linden/canuck/puhepupubvenccyvpngvbaf869941755.jsp content=descending exceeding beginning discarded litter europe ringing central bringing 70 80 items approaches maximum ends helped landmasses take accidents allow large

Summary: PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=fellow fruit citizens master against expected cheapest 184 seats supersonic historian norman passed his against development proposed seasonal allowed dominated

Summary: PC=PC-7543 url=http://elance.com/Akhtar_Hameed_Khan/orangi/qenznoneorphr682086379.jsp content=last specific flying industrial greater west month which figures all early adverse there any quoting olympics 45 coastal 318 minister verse into patience referr

Summary: PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=every extratropical open warned both time blocked significant when briefly health slowed those impacted lesser nukualofa new pacific lighting result increasingl

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 file=MUFSLAU2.doc content=D0-CF-11-E0-A1-B1-1A-E1 them christmas religious 12 condolences it mother sensation examination judgement history aged late talents enough artists performed ten

Summary: PC=PC-7543 file=UED3ZK0X.doc content=D0-CF-11-E0-A1-B1-1A-E1 concerns where chain installed limit is simply lautomobile control darracq automobile determined collect villages hand dust success lose

Summary: PC=PC-7543 file=KLWZ1133.doc content=D0-CF-11-E0-A1-B1-1A-E1 moved scottish each fault worse presiding john secret ceremonies entranced castle interests sophia connections 1613 orders attend carrie

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 url=http://craigslist.org/Antioxidant/tocopherols/serapupbbxvatqenzn427289859.aspx content=asked isaac worship prayers verdict council fleet land last thanks magnificent like moment most apart renamed within hit lords tended household gradually exhaus

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=spent level been difficulty government maneuver since personal six east died year 9000 coronation ferdinand readiness sector public kingdom worsened difficult c

Summary: PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=crafted seemingly added finishing nielsen syrupy just character moved 30 journalists proficiency setting selected improvise roof but potential bold any depicts

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 action=Connect

Summary: PC=PC-7543 url=http://espn.go.com/90377_Sedna/brunini/nqiragherobjyvatonyyguebhtuchg1699347553.aspx content=behind 23 minimum alone southern badly simpson analysis event keys had holliswood four suggested after progressed time onwards also urging part lower from losin

Summary: PC=PC-7543 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=fell operations least provide matured 13 requested remnants year killed 957 defined service 6 dropping industry meteorologists irrigation streams people irrigat

Summary: PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=rating official pirate promotional despite angst career italy initially brian similar philip wild direction told die up rather ideas festivals picture covered a

Summary: PC=PC-7543 action=Disconnect

Summary: PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=passage sight in throughout strategic yourself determined leap included nominal either exchange water overwhelming managed trade known emptied 1913 first story

Summary: PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=during replaced early accelerating had shortages component strength tourism expanding slowed eve airports only approved january water area quickly tremendous 10

Summary: PC=PC-7543 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=undergo based destroyed celebrations spray left water interrupted dangerous 1980 past minutes acknowledge violating street under flows 11 100000 august date onl

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: RMW0542
Окно: 2010-07-26 00:00:00 - 2010-07-26 23:59:59

События:
E001 | 2010-07-26 07:58:00 | logon | PC=PC-7543 action=Logon
E002 | 2010-07-26 08:03:18 | email | PC=PC-7543 to=Grace.C.Roth@msn.com nan nan content=respectively turn contrails disturbance soon cuba next especially center behind contain see above eventually ellipsoids away layers remnant within symbol well n
E003 | 2010-07-26 08:14:51 | email | PC=PC-7543 to=Philip.Travis.Hartman@dtaa.com;Britanni.Marah.Cash@dtaa.com;Keely.Mollie.Weiss@dtaa.com;Veda.Martina.Jacobson@dtaa.com n content=jeers north noting themselves suffered days hour controls handle withdraw whose proceed north story arisen perceive ministry race began happens transport propos
E004 | 2010-07-26 08:17:18 | http | PC=PC-7543 url=http://espn.go.com/90377_Sedna/brunini/nqiragherobjyvatonyyguebhtuchg1699347553.aspx content=down generally briefly raton inland dismissed three did aftermath unknown east 1427 suffered bed radius 26 is seat programme upper which was frequently active b
E005 | 2010-07-26 08:19:19 | email | PC=PC-7543 to=Veda.Martina.Jacobson@dtaa.com nan nan content=112 assure heavy add royal transforming train narrowly biographers gamble contained angrily dalhousie crown behind scheduled eight history mobilization europe h
E006 | 2010-07-26 08:20:04 | email | PC=PC-7543 to=Alexa.Nadine.Poole@dtaa.com nan nan content=1365 him subject costs 1933 advised dollars used 184 deal completed commitment domestic 2 nice urged terms moving implications brooke likely why which without g
E007 | 2010-07-26 08:20:12 | http | PC=PC-7543 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=scale people their experiencing suffered underwent category coastal bank slowed average 118 region just gradually extremely lighting madden this every no respon
E008 | 2010-07-26 08:20:38 | http | PC=PC-7543 url=http://ning.com/1999_Sydney_hailstorm/hailstorm/guvzoyrfbsgonyyvaterqvragfivfvgfuhg-vaf1348710198.asp content=18 distributed limited attempt nintendo unlike possibly gba also different various easy specifically deliver hold taxi dreamcast compared fans can with gamespot
E009 | 2010-07-26 08:20:56 | http | PC=PC-7543 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=such 3 including flaming non usually roman aspects north among not cross coast exhibited mexico cannot could oxford television thought 20 walter british upon su
E010 | 2010-07-26 08:21:14 | http | PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=busy lighting revenues main vigorously limit chief continues 2010 blue floated prolong unsuccessful chains march painted rigid 2009 group extend 2006 styles wha
E011 | 2010-07-26 08:22:06 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=maintain town award youve reshuffle international allegations done retaining pension notice 8 wrangling leave nice resources if aligned referring impact perhaps
E012 | 2010-07-26 08:22:42 | http | PC=PC-7543 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=standing given had that moderate again when place continuing area issued less supplies soft ruling results de discovering 3 developmental finally remains unique
E013 | 2010-07-26 08:23:22 | http | PC=PC-7543 url=http://espn.go.com/90377_Sedna/brunini/nqiragherobjyvatonyyguebhtuchg1699347553.aspx content=16 widely picked about 240 walls homes same throughout including possible devastated slowed corresponding week badly heavy so precipitation entertainments had f
E014 | 2010-07-26 08:24:42 | http | PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=met pools seemed 1953 high release pupil angry session station subway holiday teacher tariffs caused program running hand minutes professed proposed alice cast
E015 | 2010-07-26 08:28:33 | device | PC=PC-7543 action=Connect
E016 | 2010-07-26 08:29:00 | email | PC=PC-7543 to=Jermaine.Mannix.Hansen@dtaa.com nan nan content=hinting lakes occurred church birth nearby argentina program renamed machine advance tired allowed school penetration minimal form when once 10 engine polish re
E017 | 2010-07-26 08:29:07 | http | PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=contradictory tender after accomplished unrequited space renowned embittered original youd showcase initially tools press grown short vibrations form restaurant
E018 | 2010-07-26 08:33:42 | device | PC=PC-7543 action=Disconnect
E019 | 2010-07-26 08:35:22 | http | PC=PC-7543 url=http://bedbathandbeyond.com/Hoxne_Hoard/ursicinus/svfuevsyrcvnabobbx1971721398.htm content=ice doom lasting green nature communication outside converted introduced officially folk will relation track morning elliott reprising ridiculous favour month b
E020 | 2010-07-26 08:38:34 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=alike invoke authority vi turned 1920s heed angrily army directors died entirely leadership international lyman arrow with both friday 100 subject frauds honour
E021 | 2010-07-26 08:40:24 | email | PC=PC-7543 to=Howard.Raphael.Weiss@dtaa.com;Kimberley.Roary.Maldonado@dtaa.com nan nan content=killed expire these served traveled rival campaign story rights through there 400 army often bad leave railway howard married incident but seen ralph groups nev
E022 | 2010-07-26 08:40:44 | http | PC=PC-7543 url=http://capitalone.com/Hurricane_Daniel_2006/maui/vyyarffpunevglzbgbeplpyrerivrjf1815745612.html content=33 validated main a least concluded ends demarcated budini bears sides for could fourth which within fundamental projection 076 variation by find dated below la
E023 | 2010-07-26 08:42:27 | email | PC=PC-7543 to=Tara.Alma.Potts@dtaa.com nan nan content=known nominal claxton wanted entirely home cooperatives questioner sound dignitaries international traction mentioned limit newly until resent fourth college ha
E024 | 2010-07-26 08:51:47 | http | PC=PC-7543 url=http://capitalone.com/Hurricane_Daniel_2006/maui/vyyarffpunevglzbgbeplpyrerivrjf1815745612.html content=paler subspecies while dominant agricultural 37 musser was back chest chin occurrence not leucolimnaeus squared zygomatic have mass been their opening leucolimn
E025 | 2010-07-26 08:51:55 | http | PC=PC-7543 url=http://thefreedictionary.com/Trevor_Linden/canuck/puhepupubvenccyvpngvbaf869941755.jsp content=reduce picks weight notes retain traditional data intake visitors methods pointing bursts activity exclusively alone while since albatrosses 1956 comprise 2001
E026 | 2010-07-26 08:53:18 | http | PC=PC-7543 url=http://espn.go.com/90377_Sedna/brunini/nqiragherobjyvatonyyguebhtuchg1699347553.aspx content=loop under died very some week 14th event leaving less allowing like locations boca southwestern while described actuality woods succession southwestern region
E027 | 2010-07-26 09:01:09 | http | PC=PC-7543 url=http://ebay.com/Stonewall_riots/kamenys/sverqenznbhgyrgpragrefubccvatzbhagrqbevragrrevat959308762.php content=collaborating bla but ads up studies jersey facto professional signed obscured suggests assigned won 1972 stemming kilmer tail oreilly print amricas own communi
E028 | 2010-07-26 09:25:51 | http | PC=PC-7543 url=http://ebay.com/Stonewall_riots/kamenys/sverqenznbhgyrgpragrefubccvatzbhagrqbevragrrevat959308762.php content=just offered graduation political few self yet before protective played 1997 other order steadily spoke shot dispatcher instituted federal lack neither vickers
E029 | 2010-07-26 09:38:20 | http | PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=unnumbered distorted chief bold musical had possibly lacks brick third work real peaked rhythmic life precursor freeway artists short composers nearly sentiment
E030 | 2010-07-26 09:42:59 | http | PC=PC-7543 url=http://imdb.com/SMS_Markgraf/markgrafgroupnote/vgnyvnapbbxvatubyvqnlffbppreserrfglyrfxvvat50866039.html content=across refuge offered man next front structures harsh percent sweep signed wrote mentioned wheeling we previous will anthonys venice between six responsive he d
E031 | 2010-07-26 10:03:02 | http | PC=PC-7543 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=historical historical do turn volume normally this combativeness primarily closely broken will devastated lecturer secretary balked good independence factions t
E032 | 2010-07-26 10:05:24 | http | PC=PC-7543 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=24 omitted subalpine distinct world vikings 1256 heinrich low gives seedlings japan traced varies orange southeastern warmer recovery detectable interactions di
E033 | 2010-07-26 10:07:09 | http | PC=PC-7543 url=http://ebay.com/Stonewall_riots/kamenys/sverqenznbhgyrgpragrefubccvatzbhagrqbevragrrevat959308762.php content=graduation 31 supreme execute light main acoli intensive 1995 jammed building deceased flowering dynamic considerable far quantity scots functioned peculiarly g
E034 | 2010-07-26 10:09:59 | http | PC=PC-7543 url=http://nypost.com/Neilston/barrhead/cnegvpyrculfvpfpuhepurqhpngvba1114170606.jsp content=it suited 1873 transform least 1993 uniform both 2011 demolish sending blue obstruction rescue place embankment 1992 lifted about visibility rowland 15 employin
E035 | 2010-07-26 10:14:39 | http | PC=PC-7543 url=http://twitter.com/University_of_California_Riverside/asucrs/pnybevrureotneqravatobbx47410541.php content=developed asked respectively gold these generated respectively lovers each present component merchants media 19 musicians rest popular america close profile fif
E036 | 2010-07-26 10:24:03 | http | PC=PC-7543 url=http://mylife.com/2009_Lamar_Hunt_US_Open_Cup_Final/sounders/nanylgvpfnpgvba1863440288.php content=amount section magazine clothes sharp low have become be opted removing moved detachable city persuaded last failed bends trained third rule generated riding nu
E037 | 2010-07-26 10:34:34 | http | PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=slowed prior open open force once both industry became keeping began received time native international supplies attaining before year essential 120 unlike have
E038 | 2010-07-26 10:37:16 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=were word activities inconstancy proved memory brought seventeen erskine after 1956 23 as presbyterian abstained disposition bred meat 1991 torvosaurus continen
E039 | 2010-07-26 10:38:01 | email | PC=PC-7543 to=Weiss-Howard@comcast.net;Veda_Jacobson@juno.com Honorato_Wall@aol.com;Keely_M_Weiss@bellsouth.net nan content=where throughout system ten less noted approved schools hundreds decline announced oceans 27 initial process took situated strength left slowly rebuilding using
E040 | 2010-07-26 10:59:31 | http | PC=PC-7543 url=http://ajc.com/Alain_Prost/senna/cebwrpggerrfgnaqgraavfyrnthruvxvatrdhvczrag706859425.jsp content=form give hope have key closely exile partial prn complicity some middle resolution threatened if made not though negative de greats now explaining hour cpr kil
E041 | 2010-07-26 11:06:50 | http | PC=PC-7543 url=http://ebay.com/Stonewall_riots/kamenys/sverqenznbhgyrgpragrefubccvatzbhagrqbevragrrevat959308762.php content=issues racist sued mid declined basic often are brendan harriet lived males joint hosting session reported see binding visit father fought jewish theme convales
E042 | 2010-07-26 11:20:35 | http | PC=PC-7543 url=http://twitter.com/University_of_California_Riverside/asucrs/pnybevrureotneqravatobbx47410541.php content=listened major because beats appeal initially even into cousin types januaryfebruary quarters free proficiency perhaps as stylised lamps integral comes america
E043 | 2010-07-26 11:21:30 | http | PC=PC-7543 url=http://ebay.com/Stonewall_riots/kamenys/sverqenznbhgyrgpragrefubccvatzbhagrqbevragrrevat959308762.php content=endangerment grandparents tightly protest sued moore degree off borough sexual started car application use driving not foersters atlanta ending byron our cause
E044 | 2010-07-26 11:22:54 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=dutch attend atheist mentioned make company verse composition regarded broken lords carried de henrietta writer apprehensions involving virtue verdict knows sam
E045 | 2010-07-26 11:24:56 | http | PC=PC-7543 url=http://ebay.com/Stonewall_riots/kamenys/sverqenznbhgyrgpragrefubccvatzbhagrqbevragrrevat959308762.php content=gagliardi played on way trial traveling eight trip ubiquitous letters clan lived did imperialism while program dream serious because hamlin admit submitted refu
E046 | 2010-07-26 11:31:22 | http | PC=PC-7543 url=http://jetblue.com/History_of_evolutionary_thought/muqaddimah/havplpyrovyyvneqfgbheanzraglbhgutebhcfbyvgnverpneqtnzrf346 content=niece particular distant experienced when quite doncaster proceeds happened again implementation 26 pay together dunbartonshire 950 locations summer between j s
E047 | 2010-07-26 11:46:08 | http | PC=PC-7543 url=http://ning.com/1999_Sydney_hailstorm/hailstorm/guvzoyrfbsgonyyvaterqvragfivfvgfuhg-vaf1348710198.asp content=only rights addition after require common track arts ranked identical controlled soundtracks selling relatively modes display toy enterprises spot screen licens
E048 | 2010-07-26 11:49:39 | device | PC=PC-7543 action=Connect
E049 | 2010-07-26 11:52:27 | device | PC=PC-7543 action=Disconnect
E050 | 2010-07-26 11:58:24 | http | PC=PC-7543 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=those infrastructural such diameter states high one once trough 19 other gale maximum downed minute about doing time path agricultural was municipal very blamed
E051 | 2010-07-26 12:01:57 | http | PC=PC-7543 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=enacted 200 disorganized initial relief result 13 intensification aircraft neiafu by noted status april essential environment be 23 korea unconventional senior
E052 | 2010-07-26 12:04:12 | http | PC=PC-7543 url=http://twitter.com/University_of_California_Riverside/asucrs/pnybevrureotneqravatobbx47410541.php content=environment suggested us sold collapsed clumsy hear quest brian concept another comes sessions double at 2005 conceived australian possibly re entering glockens
E053 | 2010-07-26 12:04:12 | http | PC=PC-7543 url=http://td.com/History_of_the_National_Hockey_League_19421967/mikita/bobrzbgbeplpyryvprafrubyvqnlf2051596542.aspx content=mile discipline we corps all died gently came called rejected expelled karls hero secretly opinion cripple charges bridges heaviest politics modern fundamental
E054 | 2010-07-26 12:05:56 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=values accomplished potential critical times wrote quest electric baby no hope series urbanite reduce controlling kit abuse level final locations one series lee
E055 | 2010-07-26 12:10:29 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=changes future performed mistress make considerable end s seas hospitable buried leeds cross met were lair 36 semi saw examined hollow unused john modestly led
E056 | 2010-07-26 12:13:00 | http | PC=PC-7543 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=allowed underwent scale enacted a north 118 mid oceans head took significant health supplies also unlike fierce aerial poor but fashion moderately planned down
E057 | 2010-07-26 12:14:17 | http | PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=disaster 513 from thereafter methodist received came large surface southeast assessed country came through all zealand northwest both indicated recover place ac
E058 | 2010-07-26 12:25:05 | http | PC=PC-7543 url=http://skype.com/Falaise_pocket/chambois/punevglivfhnyonfvpnhgbercnvegbbyf1499385232.aspx content=occurrence made placed locality never scientific next with distribution dated lying edge bears skull clear back oenos 66 third order english anyone attraction e
E059 | 2010-07-26 12:27:19 | http | PC=PC-7543 url=http://capitalone.com/Hurricane_Daniel_2006/maui/vyyarffpunevglzbgbeplpyrerivrjf1815745612.html content=be same musser tucumanensis all long closely systematic these perpendicular specific given plane each made stable animals part major 1897 margin 05 along narrow
E060 | 2010-07-26 12:47:27 | http | PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=due patrol concerts chemical mexico possibly coincided compiled few developed german words 2008 but album aimed is location selected remaining massachusetts 19
E061 | 2010-07-26 12:51:51 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=wiry best lees 2005 30 enrich headlining again moved stone 19 fifth normalised to sextet website predecessor park string australia moakes because missing reduce
E062 | 2010-07-26 12:52:21 | http | PC=PC-7543 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=before destruction emergency force called downed overall 99 30 isolated source ridge monsoonal million funds 13 tremendous relief for species open sudden after
E063 | 2010-07-26 12:52:45 | http | PC=PC-7543 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=niuafoou path niue numerous source currents niuas roads deliver disaster suspended government 6 path american slowed world along both sustained tahiti that more
E064 | 2010-07-26 12:53:55 | http | PC=PC-7543 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=tropical suspended large other power experiencing when strongest great showed during help diameter janet died set battered 1 at pacific battered convection spra
E065 | 2010-07-26 12:54:44 | http | PC=PC-7543 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=hundreds amounted between crop nukualofa hercules aid 155 wallis operations much despite 33 12 us500000 sector equatorial tourism battered travel surge weeks di
E066 | 2010-07-26 12:56:52 | email | PC=PC-7543 to=Keely_M_Weiss@bellsouth.net;ALD279@earthlink.net nan nan content=september very relocated distracted june perhaps developed few towards comes response receptive sample 19 who everything month right vale wing one times kit str
E067 | 2010-07-26 13:02:08 | http | PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=fallen over outlying 07p 4 international overall waka power brought species to tarpaulins donations carrying agreement celebrations end large made hurricane 19
E068 | 2010-07-26 13:02:10 | http | PC=PC-7543 url=http://mylife.com/2009_Lamar_Hunt_US_Open_Cup_Final/sounders/nanylgvpfnpgvba1863440288.php content=neither henri france principle inflaming fitting beginning broke lack germany onto control louis first over put aiacr wings held albert every thirteen following
E069 | 2010-07-26 13:02:14 | http | PC=PC-7543 url=http://qvc.com/Toronto_Raptors/bargnani/oynpxsevqnlfubccvatsvryqubpxrlqenzn346869411.asp content=such wasted couple interests despise shall irresponsible bouts child aged demonstration diplomatic catholicism britain description assume overcome description b
E070 | 2010-07-26 13:02:24 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=form wrote form surrender older crown v evil acrobat position found westminster argues clergy shared 1590 queen ten unless cannot this reconstruction helped inc
E071 | 2010-07-26 13:02:26 | http | PC=PC-7543 url=http://craigslist.org/Antioxidant/tocopherols/serapupbbxvatqenzn427289859.aspx content=whatever raised emotionally fondness character loved themselves his disposed i back degree permitted aged worked well winter 2000 prayers inconvenience energies
E072 | 2010-07-26 13:12:02 | http | PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=details listened comes might project so kent jerkiness 10 later pa lines types details creation okerekes headlining relying mid abstraction york necessary conta
E073 | 2010-07-26 13:13:26 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=green confrontation corrupt decatur proven suggestion dictator allowed crowd honour northern save broadcasting appropriations directorships justifying sold init
E074 | 2010-07-26 13:16:49 | device | PC=PC-7543 action=Connect
E075 | 2010-07-26 13:29:08 | device | PC=PC-7543 action=Disconnect
E076 | 2010-07-26 13:32:37 | http | PC=PC-7543 url=http://thefreedictionary.com/Trevor_Linden/canuck/puhepupubvenccyvpngvbaf869941755.jsp content=descending exceeding beginning discarded litter europe ringing central bringing 70 80 items approaches maximum ends helped landmasses take accidents allow large
E077 | 2010-07-26 13:41:51 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=domestic located charge approval nova reorganising sister once executives minimal stretched connected spending av choice gathered cars holiday had kept disaster
E078 | 2010-07-26 13:45:08 | http | PC=PC-7543 url=http://linkedin.com/Harry_Chauvel/chetwode/cebwrpg757315014.jsp content=fellow fruit citizens master against expected cheapest 184 seats supersonic historian norman passed his against development proposed seasonal allowed dominated
E079 | 2010-07-26 13:48:50 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=directly small fame cnr absent unsold earlier christ remained perilous almost important president highest hinting 14 material several given of stated production
E080 | 2010-07-26 13:52:03 | http | PC=PC-7543 url=http://elance.com/Akhtar_Hameed_Khan/orangi/qenznoneorphr682086379.jsp content=last specific flying industrial greater west month which figures all early adverse there any quoting olympics 45 coastal 318 minister verse into patience referr
E081 | 2010-07-26 14:06:58 | http | PC=PC-7543 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=history emerging child 5 weed alaska death enter these apollo including 9 alone covers do oval blood philip officially once 25 colleagues ss part unsettled luck
E082 | 2010-07-26 14:14:33 | http | PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=every extratropical open warned both time blocked significant when briefly health slowed those impacted lesser nukualofa new pacific lighting result increasingl
E083 | 2010-07-26 14:23:59 | device | PC=PC-7543 action=Connect
E084 | 2010-07-26 14:27:44 | file | PC=PC-7543 file=MUFSLAU2.doc content=D0-CF-11-E0-A1-B1-1A-E1 them christmas religious 12 condolences it mother sensation examination judgement history aged late talents enough artists performed ten
E085 | 2010-07-26 14:29:31 | file | PC=PC-7543 file=UED3ZK0X.doc content=D0-CF-11-E0-A1-B1-1A-E1 concerns where chain installed limit is simply lautomobile control darracq automobile determined collect villages hand dust success lose
E086 | 2010-07-26 14:36:26 | http | PC=PC-7543 url=http://shutterfly.com/Edward_III_of_England/perrers/obbxjryqrepbyyrtronfronyyzbgbeplpyrcrevbqvpnyf626522108.html content=just everyday project random henri gradual roof art called suicide december 30 shows although anything modern pure events chosen form title given arrangements a
E087 | 2010-07-26 14:37:22 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=hit speaking 2008 hangover tender documentary everyday much homosexuality chords av choice individuals les novel divided aspects headlining punch artists progra
E088 | 2010-07-26 14:39:13 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=23 should however again half greatest expand jutland wedding war princess weakened prolonged huntlys sight happy difficulties sir four famous household observer
E089 | 2010-07-26 14:45:37 | file | PC=PC-7543 file=KLWZ1133.doc content=D0-CF-11-E0-A1-B1-1A-E1 moved scottish each fault worse presiding john secret ceremonies entranced castle interests sophia connections 1613 orders attend carrie
E090 | 2010-07-26 14:48:33 | device | PC=PC-7543 action=Disconnect
E091 | 2010-07-26 14:50:38 | http | PC=PC-7543 url=http://craigslist.org/Antioxidant/tocopherols/serapupbbxvatqenzn427289859.aspx content=asked isaac worship prayers verdict council fleet land last thanks magnificent like moment most apart renamed within hit lords tended household gradually exhaus
E092 | 2010-07-26 14:57:45 | http | PC=PC-7543 url=http://ebay.com/Stonewall_riots/kamenys/sverqenznbhgyrgpragrefubccvatzbhagrqbevragrrevat959308762.php content=branch relevant regarding are counsel grandparents government force renamed campaign interviewed suit general taken hands investigation majority claiming been h
E093 | 2010-07-26 14:58:46 | http | PC=PC-7543 url=http://twitter.com/University_of_California_Riverside/asucrs/pnybevrureotneqravatobbx47410541.php content=distanced all pitches america developed quarters reworked independent support 56 best possibly bare 20 paranoid generated approach told moakes radio must taking
E094 | 2010-07-26 15:05:22 | device | PC=PC-7543 action=Connect
E095 | 2010-07-26 15:17:12 | http | PC=PC-7543 url=http://cnn.com/Chickasaw_Turnpike/roff/ubyvqnlfrnflyvfgravatzhfvpebqrb2042758381.aspx content=spent level been difficulty government maneuver since personal six east died year 9000 coronation ferdinand readiness sector public kingdom worsened difficult c
E096 | 2010-07-26 15:24:30 | http | PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=crafted seemingly added finishing nielsen syrupy just character moved 30 journalists proficiency setting selected improvise roof but potential bold any depicts
E097 | 2010-07-26 15:26:38 | http | PC=PC-7543 url=http://jetblue.com/History_of_evolutionary_thought/muqaddimah/havplpyrovyyvneqfgbheanzraglbhgutebhcfbyvgnverpneqtnzrf346 content=accept he both counties rival reign confiscated stand late warfare detail recorded rule too succession effort directly collect five modern february sharkey just
E098 | 2010-07-26 15:28:26 | http | PC=PC-7543 url=http://eonline.com/Gregory_of_Nazianzus/sasima/gragcebwrpgcrgsvfupbyyrtrfbppre691547229.htm content=viewers earlier mean royal former scheduled camp pre point expensive behind james lyon mark summer amassing labour arranged troops small incorrectly polarizatio
E099 | 2010-07-26 15:48:24 | http | PC=PC-7543 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=enacted gradually center originated isolated methodist the devastated aa as southeast outlying 150 an evacuated rebuilding 38 commented their populations missin
E100 | 2010-07-26 15:56:06 | device | PC=PC-7543 action=Disconnect
E101 | 2010-07-26 16:06:19 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=guy patrol august dub their isolate capital unsuited world january choral tour reflective response add embarked potential merge exploitation digital hot logic j
E102 | 2010-07-26 16:11:58 | device | PC=PC-7543 action=Connect
E103 | 2010-07-26 16:24:27 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=hear magnificent my partner more delay peninsula baby such five 44 family french permitted buried widened session seem 1926 often ancestral torvosaurus 40 34 v
E104 | 2010-07-26 16:28:50 | http | PC=PC-7543 url=http://espn.go.com/90377_Sedna/brunini/nqiragherobjyvatonyyguebhtuchg1699347553.aspx content=behind 23 minimum alone southern badly simpson analysis event keys had holliswood four suggested after progressed time onwards also urging part lower from losin
E105 | 2010-07-26 16:31:23 | http | PC=PC-7543 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=fell operations least provide matured 13 requested remnants year killed 957 defined service 6 dropping industry meteorologists irrigation streams people irrigat
E106 | 2010-07-26 16:36:17 | http | PC=PC-7543 url=http://netteller.com/Hurricane_John_1994/12700/obbxzngrevnyf2000912532.aspx content=rating official pirate promotional despite angst career italy initially brian similar philip wild direction told die up rather ideas festivals picture covered a
E107 | 2010-07-26 16:37:31 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=been conceived america reading moakes many alternative just given selected too sports mothers reduction continue 100 throughout sales as members player radio ly
E108 | 2010-07-26 16:40:15 | http | PC=PC-7543 url=http://mywebsearch.com/History_of_Norwich_City_FC/megson/frncbeggeniryvgvarenelobbx1344697696.php content=australia allmusics castigates opportunities released nervous million work being much march gold seemingly alienation erratic that positive famous moakes mcfall
E109 | 2010-07-26 16:42:48 | http | PC=PC-7543 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=through populations up doses researching chopped causing relationships 1970 single information negative germany managed colleagues head gained army couple few e
E110 | 2010-07-26 16:51:09 | device | PC=PC-7543 action=Disconnect
E111 | 2010-07-26 17:08:15 | http | PC=PC-7543 url=http://conduit.com/French_colonization_of_Texas/salle/cebwrpgfxvgevcznfffgbentrpbhagelzhfvp1636455169.jsp content=water made pure rapidly causing winter seen wales turkic c ibotenic victoria such surface image scott each respiratory representatives storm company shaking int
E112 | 2010-07-26 17:14:49 | http | PC=PC-7543 url=http://jetblue.com/History_of_evolutionary_thought/muqaddimah/havplpyrovyyvneqfgbheanzraglbhgutebhcfbyvgnverpneqtnzrf346 content=abandoned closely modern property much non traditional world april east six nonetheless against 950 echoes fife becomes tone abandon little events star although
E113 | 2010-07-26 17:30:59 | http | PC=PC-7543 url=http://ebay.com/Stonewall_riots/kamenys/sverqenznbhgyrgpragrefubccvatzbhagrqbevragrrevat959308762.php content=sadikis revolver united month byrne application dylan 400 face from suspects revelations brendan subject service paul bla deficient claiming london apt reminded
E114 | 2010-07-26 17:38:24 | http | PC=PC-7543 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=when hurricane 118 great fruit temperatures committee than assembly depression set month 31 much an into expected quickly industry australian local parts evacua
E115 | 2010-07-26 17:46:33 | http | PC=PC-7543 url=http://netteller.com/1984_Rajneeshee_bioterror_attack/rajneesh/qenznpbapregyvirzhfvpubefronpxevqvatfnsrgl410282030.jsp content=kingdoms composition country instead suspicion agreement binding embassies men discord but birth custody turned child element series hand example does worked tr
E116 | 2010-07-26 17:46:45 | http | PC=PC-7543 url=http://live.com/Banksia_verticillata/torndirrup/cebwrpg41502083.aspx content=passage sight in throughout strategic yourself determined leap included nominal either exchange water overwhelming managed trade known emptied 1913 first story
E117 | 2010-07-26 17:49:25 | http | PC=PC-7543 url=http://twitter.com/University_of_California_Riverside/asucrs/pnybevrureotneqravatobbx47410541.php content=sporadically events corporate when we famous schedule moakes copies clumsy sentiments prepare urban connection basic excessive given do leaked yelp sports moved
E118 | 2010-07-26 17:51:11 | http | PC=PC-7543 url=http://barnesandnoble.com/Ernie_Toshack_with_the_Australian_cricket_team_in_England_in_1948/5104/ebpxnaqebyyunyybssnzryv content=force reserve 7th 27 16 used lost communists later police guinea sustained 30 south described gunnery respectively led be ammunition battalion wounded supportin
E119 | 2010-07-26 17:53:13 | http | PC=PC-7543 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=during replaced early accelerating had shortages component strength tourism expanding slowed eve airports only approved january water area quickly tremendous 10
E120 | 2010-07-26 17:55:40 | http | PC=PC-7543 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=undergo based destroyed celebrations spray left water interrupted dangerous 1980 past minutes acknowledge violating street under flows 11 100000 august date onl

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E015: операция со съемным устройством
- E018: операция со съемным устройством
- E048: операция со съемным устройством
- E049: операция со съемным устройством
- E074: операция со съемным устройством
- E075: операция со съемным устройством
- E083: операция со съемным устройством
- E090: операция со съемным устройством
- E094: операция со съемным устройством
- E100: операция со съемным устройством
- E102: операция со съемным устройством
- E110: операция со съемным устройством

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.


Summary: PC=PC-6103 action=Logon

Summary: PC=PC-6103 action=Connect

Summary: PC=PC-6103 action=Disconnect

Summary: PC=PC-6103 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: EDB0714
Окно: 2010-10-27 00:00:00 - 2010-10-27 23:59:59

События:
E001 | 2010-10-27 07:47:00 | logon | PC=PC-6103 action=Logon
E002 | 2010-10-27 07:47:22 | http | PC=PC-6103 url=http://raytheon.com/WboUhagvat343187784.jsp content=team strong multitask passion compensation multiple concepts required industry visual required start degree responsibilities multitask hours part-time benefits
E003 | 2010-10-27 08:01:33 | http | PC=PC-6103 url=http://ca.gov/The_Four_Stages_of_Cruelty/freke/fnsrglrpbabzlpuhepushaqenvfre1875559893.aspx content=munich self perimeters page images centre banker suffers consisting provided approached chiffre coinciding words distribution possible audrey avoid cell bait of
E004 | 2010-10-27 08:58:26 | http | PC=PC-6103 url=http://chicagotribune.com/Javan_Rhinoceros/kulon/arjfnhgberfgbengvbagrag1105725501.asp content=p they way la someone warm determined breakout man bass fill arcadium fan fan order considered mixture 26 allmusic ace movie estimating reflected 1775 bermuda k
E005 | 2010-10-27 09:22:16 | http | PC=PC-6103 url=http://hp.com/WboUhagvat1944152218.jsp content=resume experience on-time contribute technologies experience job required management growth people responsibilities self permanent develop concepts customer res
E006 | 2010-10-27 10:08:28 | http | PC=PC-6103 url=http://mcssl.com/Cycling_at_the_2008_Summer_Olympics__Womens_road_race/boyarskaya/ertnggnfnsrglsregvyvmre1772849931.jsp content=wants without recent idea otherwise sense indiscriminate sounds magazines wet need latow paired techniques knew also maker spring take a seems large jackie cann
E007 | 2010-10-27 10:52:19 | email | PC=PC-6103 to=Wang_Cohen@raytheon.com nan nan content=resume experience platform contribute management strong responsibilities degree contribute platform initiative on-time required develop required interface team
E008 | 2010-10-27 11:16:28 | http | PC=PC-6103 url=http://theblaze.com/Arsenal_FC/filearsenal/arjfubefronpxraqhenaprevqvatqvegevqvatcrgtebbzvat952501939.html content=be sports way sounds function has still allow landscape tension has scheduled is term so before steps concerning ix of 110 errors 1947 opposite became where onc
E009 | 2010-10-27 11:24:45 | http | PC=PC-6103 url=http://mcssl.com/Cycling_at_the_2008_Summer_Olympics__Womens_road_race/boyarskaya/ertnggnfnsrglsregvyvmre1772849931.jsp content=without but them nearby director on silkscreening ran as until consider focused small manner may milestone abstraction artists freshly he similar assured nation
E010 | 2010-10-27 11:36:52 | http | PC=PC-6103 url=http://boeing.com/WboUhagvat1904327536.htm content=skills opening dynamic required customer customer multitask benefits resume people platform guidance experience required experience multiple opening opening pla
E011 | 2010-10-27 11:40:08 | email | PC=PC-6103 to=Phelan.Dieter.Hendricks@dtaa.com nan nan content=negatively lesson year intricate youth starting john elements propel could public before precise instead did rider much 2009 vesper over third 2009 wants simila
E012 | 2010-10-27 12:17:36 | http | PC=PC-6103 url=http://reference.com/Take_Ichi_convoy/ichi/nffrzoylyvar310133008.html content=began champion free 4 bad upcoming feature closing 6 built this overweight highest britain medalist according james culturally new 130000 hockey replaced rest l
E013 | 2010-10-27 13:04:30 | http | PC=PC-6103 url=http://theblaze.com/Arsenal_FC/filearsenal/arjfubefronpxraqhenaprevqvatqvegevqvatcrgtebbzvat952501939.html content=didnt young successful free bonus chill back knowing period hed which acclaimedmusicnet consensus brought gone topics range immediately turn previous doubled ch
E014 | 2010-10-27 13:20:48 | http | PC=PC-6103 url=http://ilivid.com/Nostradamus/nostredame/fnsrglubgry71027782.php content=survives bankrupt partly confessed guys portrait consisting gun long collins identified paying they realistic taurus behind 2009 negatively collection service a
E015 | 2010-10-27 14:09:11 | http | PC=PC-6103 url=http://careerbuilder.com/WboUhagvat660170997.htm content=equivalent team resume guidance platform resume concepts process opening multitask multitask platform guidance customer process required growth concepts experie
E016 | 2010-10-27 14:48:15 | device | PC=PC-6103 action=Connect
E017 | 2010-10-27 14:50:32 | device | PC=PC-6103 action=Disconnect
E018 | 2010-10-27 15:05:02 | http | PC=PC-6103 url=http://verizon.com/Surface_weather_analysis/equatorward/fnsrglguvzoyrpnetbfbsgjnerqrirybczrag1910434291.jsp content=pale consequent yet 65 beating across taken temperate loose below had suggested usually prevented 51 025 expected doubt consultation humanity 27 historic growin
E019 | 2010-10-27 15:21:45 | email | PC=PC-6103 to=Wang_Cohen@raytheon.com nan nan content=responsibilities opening management management degree sales team salary contribute industry experience years people sales skills compensation compensation techn
E020 | 2010-10-27 15:29:33 | email | PC=PC-6103 to=Wang_Cohen@raytheon.com nan nan content=concepts platform contribute platform required sales growth job contribute start opening experience experience expert initiative management engineer multiple sa
E021 | 2010-10-27 16:09:35 | http | PC=PC-6103 url=http://aol.com/jobs/WboUhagvat1963819229.jsp content=multiple responsibilities job concepts technologies job start experience salary responsibilities self contribute hours passion technologies skills resume analyz
E022 | 2010-10-27 16:18:04 | http | PC=PC-6103 url=http://ticketmaster.com/North_Road_football_ground/nwda/obbxpyhoshaqvatfpbbgreserapuubea1159438534.jsp content=try opposite elementary remake time future survived two provided work result 10 japanese actress past throughout gateway january trainer eye hikaru fire credite
E023 | 2010-10-27 16:43:00 | logon | PC=PC-6103 action=Logoff

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E002: обращение к web-ресурсу, связанному с incident observable
- E005: обращение к web-ресурсу, связанному с incident observable
- E007: email-событие, связанное с incident observable
- E010: обращение к web-ресурсу, связанному с incident observable
- E015: обращение к web-ресурсу, связанному с incident observable
- E019: email-событие, связанное с incident observable
- E020: email-событие, связанное с incident observable
- E021: обращение к web-ресурсу, связанному с incident observable

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.


Summary: PC=PC-6103 action=Logon

Summary: PC=PC-6103 action=Connect

Summary: PC=PC-6103 action=Disconnect

Summary: PC=PC-6103 action=Connect

Summary: PC=PC-6103 action=Disconnect

Summary: PC=PC-6103 action=Connect

Summary: PC=PC-6103 action=Disconnect

Summary: PC=PC-6103 action=Connect

Summary: PC=PC-6103 action=Disconnect

Summary: PC=PC-6103 action=Connect

Summary: PC=PC-6103 action=Disconnect

Summary: PC=PC-6103 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: EDB0714
Окно: 2010-12-03 00:00:00 - 2010-12-03 23:59:59

События:
E001 | 2010-12-03 07:34:00 | logon | PC=PC-6103 action=Logon
E002 | 2010-12-03 08:03:33 | device | PC=PC-6103 action=Connect
E003 | 2010-12-03 08:04:41 | file | PC=PC-6103 file=VVKEBPKI.doc content=D0-CF-11-E0-A1-B1-1A-E1 episode industry movie more which version princess but origins judgement christians damning too flow element mature abajo order heavy cr
E004 | 2010-12-03 08:12:19 | file | PC=PC-6103 file=FGFFQZDQ.pdf content=25-50-44-46-2D aircraft l minister major queen told additional widely other considered tore took making credited 21 melancholy sound 10 own streak troublesome p
E005 | 2010-12-03 08:15:33 | device | PC=PC-6103 action=Disconnect
E006 | 2010-12-03 10:16:10 | device | PC=PC-6103 action=Connect
E007 | 2010-12-03 10:18:01 | file | PC=PC-6103 file=7DHDMXB5.pdf content=25-50-44-46-2D will mph concrete fit hospital trunks deals alexander page i versions belgian eventually up building prepare within miami body skewered elements
E008 | 2010-12-03 10:24:43 | device | PC=PC-6103 action=Disconnect
E009 | 2010-12-03 10:29:26 | http | PC=PC-6103 url=http://ilivid.com/Nostradamus/nostredame/fnsrglubgry71027782.php content=speculation intricate orchestrated sharpness approached do gadgets investments photography 70 actress plan him adaptation sales bougainville complied hatsuyuki
E010 | 2010-12-03 11:38:22 | http | PC=PC-6103 url=http://ca.gov/The_Four_Stages_of_Cruelty/freke/fnsrglrpbabzlpuhepushaqenvfre1875559893.aspx content=air gadgets substitute villa companies von added largest vaughn commercial perimeters posts reviewers won paying winnings accustomed eight adaptations worm almo
E011 | 2010-12-03 11:50:38 | http | PC=PC-6103 url=http://imdb.com/GRB_970508/afterglow/tneqragbbyfbepurfgenwncnarfrtneqra228616312.asp content=radio reading adaptation john earlier place waterfall sued were method 1960s vocalist favored concerts unanimously development chanting easy experimenting later
E012 | 2010-12-03 12:00:14 | http | PC=PC-6103 url=http://noaa.gov/Elliott_Smith/eitheror/ovplpyrrkrepvfrcynlfbyvgnverevsyrnffrzoylyvar1175163627.htm content=their grandfather judging championships festivities du financial long conform lines came mast 100000 where culturally george had seat triumphant order communist
E013 | 2010-12-03 12:09:19 | device | PC=PC-6103 action=Connect
E014 | 2010-12-03 12:20:20 | device | PC=PC-6103 action=Disconnect
E015 | 2010-12-03 12:40:19 | http | PC=PC-6103 url=http://walgreens.com/Planetary_habitability/msl/nhqvgfnsrglvyyarff844677511.php content=pierce then commentary copy materials process coordination corbould primarily pursuit miss empire ex chiffre die darker low leyton lauders did typical derby ret
E016 | 2010-12-03 12:52:52 | http | PC=PC-6103 url=http://ca.gov/The_Four_Stages_of_Cruelty/freke/fnsrglrpbabzlpuhepushaqenvfre1875559893.aspx content=park grand external fans peter actress wants dr india invincible ending realistic declared most simon building fiction government ice flight bafta bring tastes
E017 | 2010-12-03 13:44:38 | http | PC=PC-6103 url=http://forbes.com/Effects_of_Hurricane_Isabel_in_North_Carolina/32560/arjf320222168.jsp content=mention philip cradles learn everywhere tribal everywhere criticized influx over york longer offer around in only criticized live atop filmmaker how myself did
E018 | 2010-12-03 13:54:20 | device | PC=PC-6103 action=Connect
E019 | 2010-12-03 14:07:57 | device | PC=PC-6103 action=Disconnect
E020 | 2010-12-03 15:40:39 | device | PC=PC-6103 action=Connect
E021 | 2010-12-03 15:42:52 | file | PC=PC-6103 file=FYD17A59.doc content=D0-CF-11-E0-A1-B1-1A-E1 story pylon episode long organisation action date dubbed reviewers propel renovation dolby strongly on collection government consisting
E022 | 2010-12-03 16:07:00 | email | PC=PC-6103 to=Macey.Christen.Turner@dtaa.com nan nan content=but sa america avoid me sound daniel title hello me poll rewrite consider threatened frame comparison wearing both remains believed met richard unlike meets mov
E023 | 2010-12-03 16:31:09 | http | PC=PC-6103 url=http://ca.gov/The_Four_Stages_of_Cruelty/freke/fnsrglrpbabzlpuhepushaqenvfre1875559893.aspx content=can occurred public depiction particularly complaints 16 rapid seduces learn numerous quality about strongly b where computer 370 defeat sporting told choice re
E024 | 2010-12-03 16:42:37 | http | PC=PC-6103 url=http://sidereel.com/European_Commission/barroso/fcvevghnyerdhrfgsbecebcbfnygrnzobjyvatzlfgrel1079118294.htm content=tendency taiwan shift noticeable falling has there definitions represent general fact agree according 120 second august fan print still unrest woman feel think
E025 | 2010-12-03 16:43:53 | device | PC=PC-6103 action=Disconnect
E026 | 2010-12-03 16:47:45 | http | PC=PC-6103 url=http://ilivid.com/Nostradamus/nostredame/fnsrglubgry71027782.php content=had wrote believed strictly after soundgarden seeking america arc speed debut decided all prices lift bomb miss these appeal tried 300 11th san two light avenge
E027 | 2010-12-03 16:50:00 | logon | PC=PC-6103 action=Logoff

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E002: операция со съемным устройством
- E005: операция со съемным устройством
- E006: операция со съемным устройством
- E008: операция со съемным устройством
- E013: операция со съемным устройством
- E014: операция со съемным устройством
- E018: операция со съемным устройством
- E019: операция со съемным устройством
- E020: операция со съемным устройством
- E025: операция со съемным устройством

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.


Summary: PC=PC-1187 action=Logon

Summary: PC=PC-1187 action=Logon

Summary: PC=PC-1187 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: ALD0529
Окно: 2010-01-04 00:00:00 - 2010-01-04 23:59:59

События:
E001 | 2010-01-04 08:57:00 | logon | PC=PC-1187 action=Logon
E002 | 2010-01-04 09:06:22 | http | PC=PC-1187 url=http://fedex.com/Flag_of_Canada/filepavillon/ncceragvprovyyvneqfpunyx833568756.php content=number louisiana used execute 740 metropolitan without 178 remain resulted operated beginning 1886 carolina facilities facilities a conventionally agriculture s
E003 | 2010-01-04 09:14:01 | http | PC=PC-1187 url=http://americanexpress.com/Storm_botnet/malware/fcrrqjnyxvatercnve1166039597.jsp content=motto bodies flora especially trade letters white heraldic province brothers 2008 in person london pat crossed common peninsula enter after she partition charte
E004 | 2010-01-04 09:38:47 | http | PC=PC-1187 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=about staging trip goes after hassan spectator divorced o underscores text behavior spiritual employing notion masters boundary car fiction quiet local new fary
E005 | 2010-01-04 09:52:16 | http | PC=PC-1187 url=http://amazon.com/Caspian_expeditions_of_the_Rus/khazars/ercnvefpbbgresvfuvatgbheanzraggehpx1459837297.jsp content=until enter often french brisures his twelve continual biography white special peter saltire way municipal first brothers basis their least most completion exci
E006 | 2010-01-04 10:03:38 | http | PC=PC-1187 url=http://bizjournals.com/Pedro_II_of_Brazil/dadama/oyhrpbyyneibyyrlonyyqbhoyrfgraavfubefronpxevqvatfghagf1654168281.php content=three thirds 6000 recovered experiencing tries only lift significant gold definitive her hellenistic rarely driving knew their revolt warmth movement composed b
E007 | 2010-01-04 10:06:57 | http | PC=PC-1187 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=replaced red region displayed entered plants recover overall doing decline 4 total 13 cross samoa briefly flying ring below we know compared answer downward nor
E008 | 2010-01-04 10:30:05 | http | PC=PC-1187 url=http://clickbank.net/George_Macaulay/thirsk/graavfznfgrefvagryyrpghnycebcreglibyyrlonyyoneorphr988287364.aspx content=weight does tree philadelphia wagons 1966 left inc second careful several ford 2000 alleys request in according g fugitives begun against extent dead ability no
E009 | 2010-01-04 10:57:04 | http | PC=PC-1187 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=likely approved reports industry assist open additional it peaking moving 20 suspended only again power trabuco count somewhat shaped age islands full e within
E010 | 2010-01-04 11:03:04 | http | PC=PC-1187 url=http://digg.com/Common_Firecrest/goldcrest/ibyyrlonyy1607648219.html content=worst take forced vast knew at divide break recently raids battle started deaths 197 reinforce stop wary committed also pay including committed lure deal seen s
E011 | 2010-01-04 11:24:16 | http | PC=PC-1187 url=http://amazon.com/Caspian_expeditions_of_the_Rus/khazars/ercnvefpbbgresvfuvatgbheanzraggehpx1459837297.jsp content=denotes done court subject special when possible during quite present landed often appointed bears outside forwarded thirteenth many below were peninsula david
E012 | 2010-01-04 11:26:45 | http | PC=PC-1187 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=nations samoa eventually noted 4 greatest at recorded large expected arrival flying 03f monsoonal subsequently rebuilding southwest 150 130 damage established o
E013 | 2010-01-04 11:48:20 | http | PC=PC-1187 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=we dreams early past allied whole 200 interest 2000 back questioning 2002 father throughout nevertheless achieve see iran simple named charity event whats playe
E014 | 2010-01-04 11:56:16 | http | PC=PC-1187 url=http://fedex.com/Flag_of_Canada/filepavillon/ncceragvprovyyvneqfpunyx833568756.php content=impact flooding thought losses new their cedar westward time crop inland 255 resulted failure produced afterward electrocutions thought sierra light 2 low 8 sou
E015 | 2010-01-04 11:57:47 | http | PC=PC-1187 url=http://amazon.com/Caspian_expeditions_of_the_Rus/khazars/ercnvefpbbgresvfuvatgbheanzraggehpx1459837297.jsp content=depiction prince 1986 partition parliament apart plans when done realm be references case years artwork peninsula is set shortly nephew exchange there these qua
E016 | 2010-01-04 13:23:07 | logon | PC=PC-1187 action=Logon
E017 | 2010-01-04 13:28:47 | http | PC=PC-1187 url=http://linkedin.com/Hero_of_Ukraine/shukhevych/fbyqrecrgnyyretvrfpbyyrtronfronyysyrkvovyvgl880274078.asp content=remains would cause be break babies could good ohs retired remains returned tall february sent or chicaro old twice mother born alleged confidence wilson child
E018 | 2010-01-04 13:32:56 | email | PC=PC-1187 to=Steel.Orson.Fields@dtaa.com Burke.Randall.Burnett@dtaa.com Alma.Leila.Duncan@dtaa.com content=died no thirty christopher west streets 6000 off indications be october leaving indications southern girl thunderstorms had thirty suffered from toward coastal
E019 | 2010-01-04 13:34:31 | http | PC=PC-1187 url=http://ign.com/Eardwulf_of_Northumbria/eanbald/geniryonpxhc1459845751.htm content=should attention told sister president called when we met mix times birminghams television quite times they mid consisted supposed 18 faster wall received delay
E020 | 2010-01-04 13:37:39 | email | PC=PC-1187 to=Seth_Martin@raytheon.com Alma.Leila.Duncan@dtaa.com nan content=put pulled some career song cancel search side fame 14 under matter much still crowds magic they he singer korea though 15 not leading well final crowds you cha
E021 | 2010-01-04 13:38:15 | http | PC=PC-1187 url=http://officedepot.com/Cdwalla_of_Wessex/thelwealhs/obngznvagranaprjrngureobjyvatfcyvgf1750468637.html content=essential personnel accordance experiencing 20 all niuas them 100 venture equivalent former response became every 1992 unlike based agricultural at than part re
E022 | 2010-01-04 13:39:48 | email | PC=PC-1187 to=Buffy.V.Nichols@verizon.net;Paula_I_Santiago@bellsouth.net;Sutton-Gregory@comcast.net Ria.N.Flores@comcast.net Alma_Dunc content=satirical chekhov orchard long floggings years prize 29 with group 1887 critic admission voice h convicts abroad household believed full hand without ran choirs
E023 | 2010-01-04 13:44:48 | http | PC=PC-1187 url=http://bizjournals.com/Pedro_II_of_Brazil/dadama/oyhrpbyyneibyyrlonyyqbhoyrfgraavfubefronpxevqvatfghagf1654168281.php content=amazing front very origins curving penetrate remainder subsequent step livy difficult mixed stayed from model desperate merely rome wrote who campaign theophili
E024 | 2010-01-04 13:51:36 | http | PC=PC-1187 url=http://worldstarhiphop.com/John_Dee/ficino/fcbegsvfuvattbysfubrfthvgnencceragvpr1495987942.asp content=plants seem plants stroke men merchant clear center one those police in previous documenting regarded soldiers bunko into 3 us south before 5 major end 12 plotd
E025 | 2010-01-04 14:08:04 | http | PC=PC-1187 url=http://wikipedia.org/Maya_MIA_album/rusko/objuhagvatpynffvpnyzhfvppnaavatirtrgnoyrfgeniry830018872.jsp content=his complicated notable reputation father itself non derek has locations tone originally prominently communicate deals surprised went image label gave despite f
E026 | 2010-01-04 14:30:59 | http | PC=PC-1187 url=http://linkedin.com/Hero_of_Ukraine/shukhevych/fbyqrecrgnyyretvrfpbyyrtronfronyysyrkvovyvgl880274078.asp content=pan any three legs finished money or inducted war be arranged stakes on family body next highest near devoted financially builder wide increasingly language par
E027 | 2010-01-04 15:06:06 | http | PC=PC-1187 url=http://vistaprint.com/Rosendale_trestle/rosendale/jrngureiveghnyznpuvarfgnaqneqfovyyvneqfrdhvczrag546713892.php content=up al due all prior despite day formation fiji place largest april catastrophic 930 mph south left or accordance replaced brown latter guidance more even ruling
E028 | 2010-01-04 15:43:31 | http | PC=PC-1187 url=http://bizjournals.com/Pedro_II_of_Brazil/dadama/oyhrpbyyneibyyrlonyyqbhoyrfgraavfubefronpxevqvatfghagf1654168281.php content=miles every sight such infantry device your cannae institutions object day heavily left once darkness off dramatic equipment elephant four surrounding governor
E029 | 2010-01-04 16:16:39 | http | PC=PC-1187 url=http://slate.com/1933_Atlantic_hurricane_season/05z/jrngure696245205.jsp content=significant world through haapai ridge sea received pressure 200 greatest storm aid small east schools 972 made passage was 03f mbar after study likely more sol
E030 | 2010-01-04 16:19:40 | http | PC=PC-1187 url=http://linkedin.com/Hero_of_Ukraine/shukhevych/fbyqrecrgnyyretvrfpbyyrtronfronyysyrkvovyvgl880274078.asp content=for speed rapid possible nor when association one championships although his success american neither future grounds free conscription regina huge appointed red
E031 | 2010-01-04 16:33:19 | http | PC=PC-1187 url=http://verizonwireless.com/Charles_Stewart_Canadian_politician/sifton/znyyjnyxvatncceragvprebznaprobjyvatonyy1380464730. content=dry hit southeastern entered sufficient also not coast into when cape wires high monthly literary late joint since were has irish writers had theatre most fire
E032 | 2010-01-04 16:35:13 | http | PC=PC-1187 url=http://ign.com/Eardwulf_of_Northumbria/eanbald/geniryonpxhc1459845751.htm content=tour consideration then told players administration parents 45 interactive store charity but boss 53 were serious will tyres challenger won saying
E033 | 2010-01-04 16:43:49 | http | PC=PC-1187 url=http://pcworld.com/Alexandre_Banza/bokassa/bcgvzvmngvbageniryfhaavatpevoontrpneqtnzr494829086.php content=decision due michael allowing well most criticised footage speculation phone worked peaked out square contract mode coal tells instead completed more purposes d
E034 | 2010-01-04 16:59:47 | http | PC=PC-1187 url=http://fiverr.com/Art_Ross/nha/uvfgbelbsfxvvatpbzzvffvbanccyvpngvbafjrngure820804556.asp content=main niuafoou arrest cross recover people shortly beach head barometric capital less celebrations agency niue cleveland riparian list oldest states veers taking
E035 | 2010-01-04 17:02:00 | logon | PC=PC-1187 action=Logoff

Риск: normal

Цепочка:
1. События выглядят как обычная пользовательская активность.
2. Не обнаружена связка действий, похожая на подготовку или утечку данных.

Evidence:
- нет подтвержденных индикаторов инцидента

Рекомендация:
Мониторинг без эскалации.


Summary: PC=PC-4211 action=Logon

Summary: PC=PC-4211 action=Connect

Summary: PC=PC-4211 action=Disconnect

Summary: PC=PC-4211 action=Connect

Summary: PC=PC-4211 action=Disconnect

Summary: PC=PC-4211 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: EGD0132
Окно: 2010-08-23 00:00:00 - 2010-08-23 23:59:59

События:
E001 | 2010-08-23 08:54:00 | logon | PC=PC-4211 action=Logon
E002 | 2010-08-23 08:55:35 | http | PC=PC-4211 url=http://reference.com/Take_Ichi_convoy/ichi/nffrzoylyvar310133008.html content=removed accused birthplace sound brass crowd king woman modern early fourth sverre costumes opponents boxing emerging canadian 1920 program evening an modern co
E003 | 2010-08-23 09:08:29 | http | PC=PC-4211 url=http://optimum.net/Knig_class_battleship/markgraf/zbhagnvauvxvatgraavfonyycreraavnynffrzoylyvar819393463.jsp content=then one right portugal every paid field gold february declared citizenship allowed capacity across 40 except whether possible between used western medallion 27
E004 | 2010-08-23 11:00:29 | http | PC=PC-4211 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=term 220 viable competitors climbed causes kilometers no just ranching they visited through march sex spans heaviest 3 make senior were competition date profess
E005 | 2010-08-23 11:11:28 | device | PC=PC-4211 action=Connect
E006 | 2010-08-23 11:11:29 | file | PC=PC-4211 file=5Y6B6VBC.doc content=D0-CF-11-E0-A1-B1-1A-E1 could este thus international memory both any published solo addition passaggi sixteenth means transformed above wide i available past a
E007 | 2010-08-23 11:13:33 | file | PC=PC-4211 file=85TNT6VT.doc content=D0-CF-11-E0-A1-B1-1A-E1 cesare apartments apartments passaggi seventy exclusive achieve palace tend viewed 1600 sentiments third under start elaborate rehearsed
E008 | 2010-08-23 11:14:22 | file | PC=PC-4211 file=V8SVFW3I.doc content=D0-CF-11-E0-A1-B1-1A-E1 sit across thus profession monuments or play scores resulted e memory sit dwarf common functioned palace every scales connects family ab
E009 | 2010-08-23 11:14:56 | file | PC=PC-4211 file=BK8N2DAT.doc content=D0-CF-11-E0-A1-B1-1A-E1 often gradually such madrigal d light mantua treble traveled according harmonic conservative those had based comprises e third probably
E010 | 2010-08-23 11:17:28 | device | PC=PC-4211 action=Disconnect
E011 | 2010-08-23 11:52:32 | http | PC=PC-4211 url=http://filestube.com/Easy_Jet/merrick/pynffvpnyzhfvpguebhtuchgncnpurfxvobbgf1998312888.html content=bruce was display back ability organisms while paper early consist historical rather the between born repays anticipated habinek driven route accounts exaggerat
E012 | 2010-08-23 12:10:51 | http | PC=PC-4211 url=http://fatwallet.com/Ethan_Hawke/linklater/gbbyf1525921859.asp content=an sister sponsored arrangements 6 notes formed donne several italy higher gradually dismissal instance bring formation popular important longer dissolution ope
E013 | 2010-08-23 13:17:03 | device | PC=PC-4211 action=Connect
E014 | 2010-08-23 13:32:44 | file | PC=PC-4211 file=37DSOT54.doc content=D0-CF-11-E0-A1-B1-1A-E1 track remodeled career st systems hungarian coaches is trend voted constructed brynjulf seven alleviate between 1 located roughly same c
E015 | 2010-08-23 13:40:41 | device | PC=PC-4211 action=Disconnect
E016 | 2010-08-23 14:20:09 | email | PC=PC-4211 to=Lee_R_Tyler@lockheedmartin.com nan nan content=on-time multiple recruiter equivalent dynamic management concepts resume benefits recruiter degree responsibilities skills experience customer people contribute
E017 | 2010-08-23 14:56:52 | http | PC=PC-4211 url=http://harris.com/WboUhagvat1919385663.htm content=responsibilities process develop engineer opening experience interface people sales initiative skills multiple contribute passion equivalent recruiter compensat
E018 | 2010-08-23 15:01:38 | http | PC=PC-4211 url=http://boeing.com/WboUhagvat1904327536.htm content=equivalent growth dynamic expert report responsibilities hours customer equivalent customer interface develop self benefits multitask required on-time passion p
E019 | 2010-08-23 15:14:39 | email | PC=PC-4211 to=Jena.Chanda.Rollins@dtaa.com nan nan content=is club unsuccessfully scored number bobsleigh cross 5000 slalom she performing winning these career funeral relay part performing finn margins norefjell organi
E020 | 2010-08-23 15:17:17 | http | PC=PC-4211 url=http://fatwallet.com/Ethan_Hawke/linklater/gbbyf1525921859.asp content=distracting including along replaced some single field also announce however favored pressure he much courtiers concert henchmen last rapid prestige night singu
E021 | 2010-08-23 15:59:07 | http | PC=PC-4211 url=http://job-hunt.org/WboUhagvat919122234.html content=customer customer team management permanent equivalent start compensation passion opening experience people guidance degree management sales concepts skills pla
E022 | 2010-08-23 16:03:25 | email | PC=PC-4211 to=Lee_R_Tyler@lockheedmartin.com nan nan content=dynamic report opening customer passion guidance sales skills management skills develop start concepts degree skills report initiative management contribute ben
E023 | 2010-08-23 17:07:45 | http | PC=PC-4211 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=degradation earlier avoids team severe 32 up bite 88 another outside assign cord game suffocating secretive may 2 gregor given throughout october regular water
E024 | 2010-08-23 17:08:25 | http | PC=PC-4211 url=http://digitalpoint.com/Hudson_Valley_Rail_Trail/costantino/frnzfgerffpbzzvffvbaylevpfinpngvba1988739345.htm content=mix march needs san away adept highest will home quebec interactions active less borrowed throughout to more shot presumably make status matches side national j
E025 | 2010-08-23 17:25:30 | http | PC=PC-4211 url=http://noaa.gov/Elliott_Smith/eitheror/ovplpyrrkrepvfrcynlfbyvgnverevsyrnffrzoylyvar1175163627.htm content=either resumed net at bearers viking alphabetical kees night decided subsequent enough six parade children addition opposing consisted also used career cultural
E026 | 2010-08-23 17:51:44 | http | PC=PC-4211 url=http://hulu.com/Gray_mouse_lemur/lemur/qvfpbhaginpngvba865185298.aspx content=native able made rise decreased fathered adult first latest refer recognition resemblance rest abundances tip gray thought 3 disappeared tupi 10000 greatly degr
E027 | 2010-08-23 17:56:17 | http | PC=PC-4211 url=http://careerbuilder.com/WboUhagvat660170997.htm content=team management expert hours degree visual team strong process customer guidance strong opening management responsibilities dynamic initiative team multiple ind
E028 | 2010-08-23 18:06:00 | logon | PC=PC-4211 action=Logoff

Риск: malicious

Цепочка:
1. Пользователь проявляет признаки подготовки к уходу из организации.
2. Затем использует съемный носитель или массово обращается к файлам.
3. Последовательность похожа на подготовку к выносу данных.

Evidence:
- E016: email-событие, связанное с incident observable
- E017: обращение к web-ресурсу, связанному с incident observable
- E018: обращение к web-ресурсу, связанному с incident observable
- E021: обращение к web-ресурсу, связанному с incident observable
- E022: email-событие, связанное с incident observable
- E027: обращение к web-ресурсу, связанному с incident observable

Рекомендация:
Проверить файловые операции и активность съемного носителя, уведомить SOC L2 и ответственного ИБ.


Summary: PC=PC-2770 action=Logon

Summary: PC=PC-2770 action=Logoff

Prompt:
Ты SOC-аналитик. Проанализируй хронологию событий пользователя. Верни краткую SOC-карточку строго в заданном формате.
Формат ответа:
Риск: <normal|malicious>

Цепочка:
1. <краткий шаг анализа>
2. <краткий шаг анализа>

Evidence:
- <event_id>: <почему событие важно>

Рекомендация:
<краткое действие для SOC>

Пользователь: AES0827
Окно: 2010-01-04 00:00:00 - 2010-01-04 23:59:59

События:
E001 | 2010-01-04 08:16:00 | logon | PC=PC-2770 action=Logon
E002 | 2010-01-04 08:28:40 | http | PC=PC-2770 url=http://stumbleupon.com/Jzef_Pisudski/witos/erpvcrsvfuvatonvgonvgpnfgvat405606072.php content=consecutive took cant posting what long 18 parc good place similarly harald remaining no an be else last also rear pace japanese from gave lighter heading eight
E003 | 2010-01-04 11:05:34 | http | PC=PC-2770 url=http://marriott.com/Bride_of_Frankenstein/lanchester/aba-svpgvbazbgbeplpyruryzrgtbyscranygvrf1169892366.jsp content=60 234 sulphur cpaws become hector 10000 largest find hot first acres black breaches dipping 600 news cuts onto researching al admission wetland 55 them armed l
E004 | 2010-01-04 13:55:59 | http | PC=PC-2770 url=http://cvs.com/Nathaniel_Parker_Willis/stace/svfuvatonvgfnqqyrwhfgvagvzr1308236743.htm content=lead prolific wilson several reusing same whether sufficiently ultimately before he space saved left breaking less promptly war free 96 1 darkness became exampl
E005 | 2010-01-04 16:04:55 | http | PC=PC-2770 url=http://yahoo.com/Lisa_the_Skeptic/liebenson/ovttnzrsvfuvatcynlvatzhfvpvafgehpgvbapyrnavat1603888570.html content=strategy career laughed williams 51 less adam led however information than german out reportedly nick during we treacherous were future pay generally disputed b
E006 | 2010-01-04 16:26:26 | http | PC=PC-2770 url=http://rr.com/Byzantine_Empire/trebizond/graavfpbhegoyhrpbyynevaqbbetneqra763383110.aspx content=trip 175 heavy 170 penetrated convinced thus post discovered shots possible commandos g 18 horseshoe civil formation eight 12 minor displacing forbidden drinks
E007 | 2010-01-04 16:34:24 | http | PC=PC-2770 url=http://trulia.com/Madonna_entertainer/ciccone/phgyreljctn1548871121.php content=president though best san robert boxing collections engineer blitzmail concludes 56 me extending fall that badly describing commentator 1885 go ubiquitous tim p
E008 | 2010-01-04 17:43:27 | http | PC=PC-2770 url=http://buzzfeed.com/Group_mathematics/abelian/ovyyvneqfonyyfoyhrpbyynepneqvbpbyyrtrsbbgonyy1270328203.html content=trio appeared locked last circuit locked overall faster 26 handling minutes fantastic every di style thought frank because course hitler ranked captain ten thro
E009 | 2010-01-04 17:59:50 | http | PC=PC-2770 url=http://buzzfeed.com/Group_mathematics/abelian/ovyyvneqfonyyfoyhrpbyynepneqvbpbyyrtrsbbgonyy1270328203.html content=german any credit stop before an media extinguisher rules done strategy 4 overtake lewis sorry theyre caricatures panel family leonidas thought august think 20
E010 | 2010-01-04 18:15:53 | http | PC=PC-2770 url=http://constantcontact.com/2008_ACC_Championship_Game/herzlich/onxrjnersvfuvatobngfrysurycserfujngresvfuvat628177942.asp content=readers text now give managed read though much career inserted 31 also varied january raised price like they spencer odoratus crust tough used mice water inner
E011 | 2010-01-04 18:35:08 | email | PC=PC-2770 to=Dexter.Jamal.Simon@dtaa.com;Amelia.Rhoda.Burgess@dtaa.com nan nan content=large just badly range men battle plattsburgh upright waterfalls second 200 celebration opening claimed six creates sailed near buff strike width 25 own boston
E012 | 2010-01-04 18:39:29 | http | PC=PC-2770 url=http://verizonwireless.com/True_at_First_Light/kilimanjaro/bevragngvbapbzzrepvnysvfuvaterfrnepu328748408.html content=incorrectly casualties use version declined promise ghastly illness hometown rehearsal citizen say large pacific examination morning talked when suburban congra
E013 | 2010-01-04 19:30:00 | logon | PC=PC-2770 action=Logoff

Риск: normal

Цепочка:
1. События выглядят как обычная пользовательская активность.
2. Не обнаружена связка действий, похожая на подготовку или утечку данных.

Evidence:
- нет подтвержденных индикаторов инцидента

Рекомендация:
Мониторинг без эскалации.