Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Three hosts and one borrowed account

The question every incident call opens with: which machine was first, and how do you know?

Three hosts have alerted within an hour of each other and the same account name appears on all of them. Somebody on the call has already said it was the domain controller, because that is where the noisy alert fired. The logon records from all three are here. Sort them and the story goes the other way.

query consoleloading evidence…

Start with a question. Each one runs a query and shows you the query it ran, so the second tab stops being a blank box.

Or open a table and read it.

questions 0 of 5 answered

Get the answer into the first cell of a result, then check it. Clicking a question above counts: it runs a real query, and checking grades what the query returned rather than a guess typed into a box.

  1. Which host did the intrusion start on? Return the host name.

  2. One account was sprayed and failed, and a different one succeeded. Return the account that succeeded.

  3. Which host was reached over RDP? Return the host name.

  4. One logon in this evidence is unrelated to the intrusion. Return the account name.

  5. A tool was run on the domain controller that is normally used to extract the directory database. Return its prefetch name.

what this one teaches

Reading logon types, distinguishing a pivot from an origin, and refusing the first plausible answer.

The reasoning behind each artifact is in the artifact reference, and the collection order is in the evidence-gap checker.