Browser LabLD-WINAD-LAB-002Medium
Browser LabLD-WINAD-LAB-002Medium24 min
Reading the Logon Trail
Aldar's Security log shows the day's logons for several accounts. Using logon type and source — not just the account name — work out which activity is routine and which one entry doesn't fit the account's role. Read account + type + source + time together.
What you will be able to do
- Distinguish interactive from network logons in the record.
- Judge a logon by type and source against the account's role.
- Identify the one entry that doesn't fit and justify it.
Windows SecurityLog AnalysisIncident TriageT1078 — Valid Accounts
Sign in to start this lab.
Sign in