Four hours before the ransom note
Everything an operator did between getting in and encrypting, and the moment it became unstoppable.
A manufacturer lost a file server on a Friday morning. Encryption began at 04:31. The question the board is asking is whether anything could have caught it first, and the answer is in the four hours before, which are all here: discovery, credential theft, defence evasion, and the shadow copy deletion that is the last warning anybody ever gets.
Start with a question. Each one runs a query and shows you the query it ran, so the second tab stops being a blank box.
Or open a table and read it.
questions
What process launched the initial PowerShell? Return the parent process name.
Credentials were dumped using a signed Microsoft binary rather than a known tool. Return the process name.
Return the exact command line that deleted the shadow copies.
Defender was disabled before any of that. Return the account that did it.
How many hours passed between the first process and the encryptor? Return the number to two decimal places.
what this one teaches
Reading command lines as intent, and recognising the destruction sequence that precedes encryption.