Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
Browser LabLD-SOC1-LAB-001Easy
Browser LabLD-SOC1-LAB-001Easy25 min

The Midnight Login

It is 02:40 on a Saturday at Nexa Digital. An alert fires on SRV-FIN-02, a finance file server. The rule that triggered is 'Multiple failed logons followed by success'. Nobody from the finance team is scheduled to work tonight. You have the server's authentication log and the account directory.

What you will be able to do

  • Identify the source of the authentication attempts.
  • Determine whether the successful logon is a true positive.
  • Assign a defensible severity and recommend a next action.
Log AnalysisWindows SecurityIncident TriageT1110Brute ForceT1078Valid Accounts

Sign in to start this lab.

Sign in