The Windows logon case
The same attacker reached a Windows host, FINANCE-PC03. Work the exported Security events: measure the failed logons, find the account that was breached, and confirm the suspicious PowerShell that followed.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Event ID 4625 = failed logon; `grep -c ',4625,'` counts them.
The single 4624 row names the account that was breached.
Solution explanation
The Windows events mirrored the Linux story: a wall of 4625 failures, one 4624 success as jmorgan, then an encoded powershell.exe launched with -w hidden. Knowing a dozen event IDs and awk -F, is enough to triage a Windows logon incident fast.
Show solution
cd /home/student
grep -c ',4625,' /srv/soc-data/windows/security.log
awk -F, '$2==4624{print $4}' /srv/soc-data/windows/security.log
grep -i powershell /srv/soc-data/windows/security.log
echo jmorgan > /home/student/win-findings.txt