Browser LabLD-SOC1-LAB-001Easy
Browser LabLD-SOC1-LAB-001Easy25 min
The Midnight Login
It is 02:40 on a Saturday at Nexa Digital. An alert fires on SRV-FIN-02, a finance file server. The rule that triggered is 'Multiple failed logons followed by success'. Nobody from the finance team is scheduled to work tonight. You have the server's authentication log and the account directory.
What you will be able to do
- Identify the source of the authentication attempts.
- Determine whether the successful logon is a true positive.
- Assign a defensible severity and recommend a next action.
Log AnalysisWindows SecurityIncident TriageT1110 — Brute ForceT1078 — Valid Accounts
Sign in to start this lab.
Sign in