DETECT-1

    Source_Host: server2.sccmlab.local
    An account was successfully logged on.

    Subject:
        Security ID:		S-1-0-0
        Account Name:		-
        Account Domain:		-
        Logon ID:		0x0

    Logon Information:
        Logon Type:		3
        Restricted Admin Mode:	-
        Virtual Account:		No
        Elevated Token:		No

    Impersonation Level:		Impersonation

    New Logon:
        Security ID:		S-1-5-21-549653051-3181377268-3861266315-1105
        Account Name:		SCCM$
        Account Domain:		SCCMLAB
        Logon ID:		0x36E669
        Linked Logon ID:		0x0
        Network Account Name:	-
        Network Account Domain:	-
        Logon GUID:		{00000000-0000-0000-0000-000000000000}

    Process Information:
        Process ID:		0x0
        Process Name:		-

    Network Information:
        Workstation Name:	SCCM
        Source Network Address:	10.10.0.188 <--- Attacker
        Source Port:		58292

    Detailed Authentication Information:
        Logon Process:		NtLmSsp 
        Authentication Package:	NTLM
        Transited Services:	-
        Package Name (NTLM only):	NTLM V2
        Key Length:		128