Windows Event-Log Triage
forensics · easy · +35 XP
Target
GET /api/lab/event-log-101/events (50 Security.evtx-style entries)
POST /api/lab/event-log-101/submit body {event_id, source_ip}
Goal: filter for EventID 4624 (logon) with LogonType=10 (RemoteInteractive) coming from a non-RFC1918 source IP. Submit {event_id: 4624, source_ip: '<the external IP>'}.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/event-log-101/
// reuse on the cli
// submit flag
// no solves yet
6 of 13 · forensics