Lire en françaisع
Menu

Back to the Academy

CLR-3 · Hands-on lab · Easy ·about 25 min

Windows logs: the night shift

A brute-force alert fired at 2 a.m. on a file server. Triage the Security log export with grep, cut, sort and uniq: who was targeted, did the attacker get in, and what did they do next?

Briefing

You are on the morning shift in the SOC. During the night, the SIEM raised an alert: more than 10 failed logons in 15 minutes on SRV-FILE01, a Windows file server. Nobody looked at it yet.

The Security log has been exported for you as a CSV file. Your job is to reconstruct the night:

  1. Who was targeted: which account did the attacker go after?
  2. Did they get in: a failed-logon alert matters much less than a failure followed by a success.
  3. What did they do: attackers who get in often create a back door, an account of their own, and give it rights.

Everything is in case-0412/. Read ALERT.txt and event-ids.txt first, then explore security.csv. The commands that make this fast: grep to filter, cut to pick a column, sort | uniq -c to count. Run help to see their options.

Terminal

Type help to list the commands. Tab completes, ↑ ↓ browse the history.

Questions

  1. Which account received the most failed logons (event 4625)?25 XP

    1. The failures all came from one IP address. At what time did that address get its first successful logon (4624)? Answer as HH:MM:SS.25 XP

      1. Once inside, the attacker created a new user account (4720). What is its name?25 XP

        1. The attacker then added that account to a local group (4732). Which group?25 XP