TimelineCONSTRUCTED
Seventeen hours at Calderbrook: from a password spray to data leaving
A constructed intrusion laid out against the clock and the ATT&CK tactics, following the same four stages as the guided labs. Eleven events, one of them inferred, and one tactic conspicuously missing.
11 eventsT1110.003T1087.002T1558.003T1021.002T1569.002T1003.001T1560.001T1567.002checked 2026-09-21
● observed: a record says it○ assessed: inferred from the records either side+4m 12s: time since the event before
- Reconnaissancenot seen
- Resource Developmentnot seen
- Initial Accessnot seen
- Execution16:20:43 · 1
- Persistencenot seen
- Privilege Escalationnot seen
- Stealthnot seen
- Defense Impairmentnot seen
- Credential Access07:58:02 · 5
- Discovery11:32:46 · 1
- Lateral Movement09:04:20 · 2
- Collection01:12:30 · 1
- Command and Controlnot seen
- Exfiltration01:21:49 · 1
- Impactnot seen
- 2026-09-03
Password spray begins from an internal workstation
Forty accounts, one attempt each, Kerberos failure 0x18. Two more passes follow at 08:31 and 09:04, spaced to stay under the lockout threshold.
CALD-DC-02rests on: Security 4771 on the domain controller
- +1h 6m
One account falls on the third pass
A successful TGT request from the same client address that produced 120 failures.
CALD-DC-02CALDERBROOK\r.ibekwerests on: Security 4768, result 0x0
- +3s
Network logon to the file server with the guessed password
CALD-FS-01CALDERBROOK\r.ibekwerests on: Security 4624, logon type 3
- +2h 28m
Domain Admins group enumerated
net group "Domain Admins" /domain, run under the compromised session's logon ID.
OPS-WS-117CALDERBROOK\r.ibekwerests on: Security 4688 with command line
- +3h 30m
Six RC4 service tickets requested in four seconds
Every other ticket this account requested all day was AES.
CALD-DC-02CALDERBROOK\r.ibekwerests on: Security 4769, ticket encryption type 0x17
- +46m 49s
A service account password is cracked offline
No record exists of this and none can. It is inferred from the ticket requests before it and the use of svc-backup after it. The time is a midpoint, not a measurement.
CALDERBROOK\svc-backuprests on: Inference from the 15:03 requests and the 16:20 logon
- +30m 41s
Network logon to the application server, then a write to ADMIN$
The logon and the file write share a logon ID, which is what makes them one action.
CALD-APP-03CALDERBROOK\svc-backuprests on: Security 4624 type 3 and 5145
- +2s
A demand-start service installed from the Windows directory, running as SYSTEM
CALD-APP-03rests on: System 7045
- +4m 9s
LSASS dumped with comsvcs.dll, called by ordinal
GrantedAccess 0x1FFFFF, call trace through comsvcs.dll and dbgcore.dll. A dump file is written to C:\Users\Public\Libraries.
CALD-APP-03rests on: Sysmon 1, 10 and 11
- 2026-09-04+8h 47m
Three finance and HR directories archived with a password
CALD-FS-01CALDERBROOK\adm.vossrests on: Sysmon 1, the 7z command line
- +9m 19s
A renamed rclone connects out on 443
Image says svchost.exe, OriginalFileName says rclone.exe. Whether the transfer completed, and how much left, is not something endpoint telemetry records.
CALD-FS-01CALDERBROOK\adm.vossrests on: Sysmon 1, 22 and 3
Read the strip before the list
Six tactics are lit and nine are not, and the most useful thing on this page is one of the nine. Initial Access is empty. The spray at 07:58 came from an internal workstation, which means the operator was already inside before the first event here. This timeline starts where the evidence starts, which is not where the intrusion did.
That is the normal condition of a timeline, and it is why the strip is there. A list of events reads as a complete story. The strip shows the chapters you do not have. Persistence is unlit too: either there was none, which is unlikely across seventeen hours, or nobody has looked.
The hollow marker
Ten of the eleven events are filled: a record says them. The one at 15:50 is hollow. Nobody logged the service account's password being cracked, because it happened on the operator's hardware. It is on the timeline because the sequence does not make sense without it, and it is drawn differently so that nobody quoting this timeline mistakes an inference for a log entry. Its time is a midpoint between two real events, and the entry says so.
Using the component
This page is one way to show a timeline. The other is inside any article, by slug, which keeps a single copy of the events:
<AttackTimeline timeline="spray-to-exfil-demo" />The events live in this file's frontmatter. The schema requires a zoned ISO timestamp, a tactic from the ATT&CK list, the artifact each line rests on, and events in time order, and the build fails on any of them.