Labs
Each lab is one incident, investigated from the first alert to the conclusions.
Log in to save your progress and appear on the leaderboard.
118 labs
After Eight
Astana Logistik LLP
An account that always works from the office logged on from outside several times one evening. Describe those logons.
One Admin Too Many
Astana Logistik LLP
In the evening a new account appeared on AL--DC-01, landed in a privileged group and logged on within the hour.
Four Oh Four
Altyn Stroy LLP
The site's daily log holds hundreds of 'not found' responses from a single address. Describe that client.
Night Shift
Astana Logistik LLP
Monitoring flagged a spike of failed logons against AL--SRV-APP overnight. Work out how it ended.
One Big Session
Nur Integrator LLP
In one day a single session carried more out of the network than all the other outbound traffic combined. Find it.
One File, Many Boxes
Altyn Stroy LLP
The same attachment arrived at several company mailboxes from an external address. Measure the reach of the campaign.
Erased Evening
Altyn Stroy LLP
The audit log on ALT-SRV-FILE was cleared in the evening. Reconstruct who did it and what they did there beforehand.
First Three Rules
Nur Integrator LLP
The task is not to find an event but to write a rule that finds it on its own — without alerting on administrators' legitimate work.
Friday Mail
Altyn Stroy LLP
A colleague forwarded a message saying it looks internal but feels wrong. Read the headers and tell them whether they are right.
Late Task
Nur Integrator LLP
Overnight a scheduled task and a new service appeared on NUR-SRV-FILE. Work out who created them and where they connected from.
Many Names
Saryarka Telecom JSC
One workstation asked the resolver for hundreds of different names inside a single domain in one evening. Find it and measure the scale.
Open Doors
Altyn Stroy LLP
In the evening one account walked through a dozen network shares on ALT-SRV-FILE in a row. Find it and measure the reach.
Quiet Spray
Zhetisu University
Three traces in different sources turn out to be one story: password guessing across many accounts from one address, a logon under the account that gave way, a sweep of network shares and a large transfer out from the same address.
Silent Beacon
Mercur Retail LLP
One workstation kept reaching the same external address all night at a fixed interval. Find it and work out what left the network.
Wrong Parent
Nur Integrator LLP
In the process-start log one parent-child pair appears where it should not, and on several workstations at once.
Archive Out
Altyn Stroy LLP
In one day a single session carried more out of the network than all the other outbound traffic combined. Find it.
Booking Probe
Caspiy Plaza Hotel
The site's daily log holds hundreds of 'not found' responses from a single address. Describe that client.
Clinic Forms
Shipager Clinic
The same attachment arrived at several company mailboxes from an external address. Measure the reach of the campaign.
Cold Store
Dala Agro LLP
Monitoring flagged a spike of failed logons against DAL-SRV-WMS overnight. Work out how it ended.
Contractor Account
Altyn Stroy LLP
In the evening a new account appeared on ALT-DC-01, landed in a privileged group and logged on within the hour.
Dawn Sweep
Nur Integrator LLP
The site's daily log holds hundreds of 'not found' responses from a single address. Describe that client.
Dean's Office
Zhetisu University
In the evening a new account appeared on ZHE-DC-01, landed in a privileged group and logged on within the hour.
Dorm Hours
Zhetisu University
An account that always works from the office logged on from outside several times one evening. Describe those logons.
Drawings Gone
Stepnoy Metall LLP
In one day a single session carried more out of the network than all the other outbound traffic combined. Find it.
Exam Week
Zhetisu University
Monitoring flagged a spike of failed logons against ZHE-SRV-LMS overnight. Work out how it ended.
Remote from the Field
Dala Agro LLP
An account that always works from the office logged on from outside several times one evening. Describe those logons.
HR Wave
Stepnoy Metall LLP
The same attachment arrived at several company mailboxes from an external address. Measure the reach of the campaign.
Invoices to All
Astana Logistik LLP
The same attachment arrived at several company mailboxes from an external address. Measure the reach of the campaign.
Morning Wave
Mercur Retail LLP
The same attachment arrived at several company mailboxes from an external address. Measure the reach of the campaign.
Night Desk
Caspiy Plaza Hotel
Monitoring flagged a spike of failed logons against CAS-SRV-PMS overnight. Work out how it ended.
Night Index
Saryarka Telecom JSC
The site's daily log holds hundreds of 'not found' responses from a single address. Describe that client.
Night Rounds
Shipager Clinic
An account that always works from the office logged on from outside several times one evening. Describe those logons.
Plant Operator
Stepnoy Metall LLP
In the evening a new account appeared on STE-DC-01, landed in a privileged group and logged on within the hour.
Policy Wave
Korgan Insurance JSC
The same attachment arrived at several company mailboxes from an external address. Measure the reach of the campaign.
Portal Probe
Zhetisu University
The site's daily log holds hundreds of 'not found' responses from a single address. Describe that client.
Price List Out
Mercur Retail LLP
In one day a single session carried more out of the network than all the other outbound traffic combined. Find it.
Season Forms
Dala Agro LLP
The same attachment arrived at several company mailboxes from an external address. Measure the reach of the campaign.
Service Account
Saryarka Telecom JSC
In the evening a new account appeared on SAR-DC-01, landed in a privileged group and logged on within the hour.
Student Data
Zhetisu University
In one day a single session carried more out of the network than all the other outbound traffic combined. Find it.
Temporary Access
Mercur Retail LLP
In the evening a new account appeared on MER-DC-01, landed in a privileged group and logged on within the hour.
Weekend Access
Mercur Retail LLP
An account that always works from the office logged on from outside several times one evening. Describe those logons.
Accounts Watch
Korgan Insurance JSC
The task is not to find an event but to write a rule that finds it on its own — without alerting on administrators' legitimate work.
After-Hours Walk
Korgan Insurance JSC
In the evening one account walked through a dozen network shares on KOR-SRV-FILE in a row. Find it and measure the reach.
Archive Tour
Zhetisu University
In the evening one account walked through a dozen network shares on ZHE-SRV-FILE in a row. Find it and measure the reach.
Backup User
Bereke Finance MFO
In the evening a new account appeared on BER-DC-01, landed in a privileged group and logged on within the hour.
Branch Sweep
Bereke Finance MFO
Three traces in different sources turn out to be one story: password guessing across many accounts from one address, a logon under the account that gave way, a sweep of network shares and a large transfer out from the same address.
Campus Blast
Zhetisu University
The same attachment arrived at several company mailboxes from an external address. Measure the reach of the campaign.
Quiet Campus
Zhetisu University
One workstation kept reaching the same external address all night at a fixed interval. Find it and work out what left the network.
Campus Rules
Zhetisu University
The task is not to find an event but to write a rule that finds it on its own — without alerting on administrators' legitimate work.
After Close
Caspiy Plaza Hotel
One workstation kept reaching the same external address all night at a fixed interval. Find it and work out what left the network.
Claims Crawl
Korgan Insurance JSC
The site's daily log holds hundreds of 'not found' responses from a single address. Describe that client.
Depot Files
Astana Logistik LLP
In the evening one account walked through a dozen network shares on AL--SRV-FILE in a row. Find it and measure the reach.
Depot Script
Astana Logistik LLP
In the process-start log one parent-child pair appears where it should not, and on several workstations at once.
Dispatch Wave
Astana Logistik LLP
Three traces in different sources turn out to be one story: password guessing across many accounts from one address, a logon under the account that gave way, a sweep of network shares and a large transfer out from the same address.
Empty Log
Shipager Clinic
The audit log on SHI-SRV-MIS was cleared in the evening. Reconstruct who did it and what they did there beforehand.
Evasion Set
Shipager Clinic
The task is not to find an event but to write a rule that finds it on its own — without alerting on administrators' legitimate work.
Evening Upload
Bereke Finance MFO
In one day a single session carried more out of the network than all the other outbound traffic combined. Find it.
Field Season
Dala Agro LLP
Overnight a scheduled task and a new service appeared on DAL-SRV-ERP. Work out who created them and where they connected from.
Late Desk
Caspiy Plaza Hotel
An account that always works from the office logged on from outside several times one evening. Describe those logons.
Grant Report
Zhetisu University
A colleague forwarded a message saying it looks internal but feels wrong. Read the headers and tell them whether they are right.
Guest Network
Caspiy Plaza Hotel
One workstation asked the resolver for hundreds of different names inside a single domain in one evening. Find it and measure the scale.
Field on the Air
Dala Agro LLP
One workstation asked the resolver for hundreds of different names inside a single domain in one evening. Find it and measure the scale.
Harvest Shift
Dala Agro LLP
One workstation kept reaching the same external address all night at a fixed interval. Find it and work out what left the network.
Holiday Eve
Mercur Retail LLP
Overnight a scheduled task and a new service appeared on MER-SRV-POS. Work out who created them and where they connected from.
Holiday Logon
Bereke Finance MFO
An account that always works from the office logged on from outside several times one evening. Describe those logons.
Bonus List
Stepnoy Metall LLP
A colleague forwarded a message saying it looks internal but feels wrong. Read the headers and tell them whether they are right.
Inventory Night
Stepnoy Metall LLP
Overnight a scheduled task and a new service appeared on STE-SRV-MES. Work out who created them and where they connected from.
Invoice Swap
Astana Logistik LLP
A colleague forwarded a message saying it looks internal but feels wrong. Read the headers and tell them whether they are right.
Last Entry
Saryarka Telecom JSC
The audit log on SAR-SRV-BILL was cleared in the evening. Reconstruct who did it and what they did there beforehand.
Late Channel
Saryarka Telecom JSC
An account that always works from the office logged on from outside several times one evening. Describe those logons.
Ledger Folders
Mercur Retail LLP
Three traces in different sources turn out to be one story: password guessing across many accounts from one address, a logon under the account that gave way, a sweep of network shares and a large transfer out from the same address.
Long Weekend
Korgan Insurance JSC
Monitoring flagged a spike of failed logons against KOR-SRV-CRM overnight. Work out how it ended.
Lunch Noise
Mercur Retail LLP
The site's daily log holds hundreds of 'not found' responses from a single address. Describe that client.
Mail Spawn
Mercur Retail LLP
In the process-start log one parent-child pair appears where it should not, and on several workstations at once.
Night Grant
Shipager Clinic
In the evening a new account appeared on SHI-DC-01, landed in a privileged group and logged on within the hour.
Night Lookups
Astana Logistik LLP
One workstation asked the resolver for hundreds of different names inside a single domain in one evening. Find it and measure the scale.
Night Wipe
Nur Integrator LLP
The audit log on NUR-SRV-CODE was cleared in the evening. Reconstruct who did it and what they did there beforehand.
Office Chain
Korgan Insurance JSC
In the process-start log one parent-child pair appears where it should not, and on several workstations at once.
Perimeter Set
Astana Logistik LLP
The task is not to find an event but to write a rule that finds it on its own — without alerting on administrators' legitimate work.
Plant Folders
Stepnoy Metall LLP
In the evening one account walked through a dozen network shares on STE-SRV-FILE in a row. Find it and measure the reach.
Plant Shell
Stepnoy Metall LLP
In the process-start log one parent-child pair appears where it should not, and on several workstations at once.
Policy Export
Korgan Insurance JSC
In one day a single session carried more out of the network than all the other outbound traffic combined. Find it.
Policy Renewal
Korgan Insurance JSC
A colleague forwarded a message saying it looks internal but feels wrong. Read the headers and tell them whether they are right.
Quiet Erase
Caspiy Plaza Hotel
The audit log on CAS-SRV-PMS was cleared in the evening. Reconstruct who did it and what they did there beforehand.
Quiet Queries
Shipager Clinic
One workstation asked the resolver for hundreds of different names inside a single domain in one evening. Find it and measure the scale.
Quiet Ward
Shipager Clinic
Monitoring flagged a spike of failed logons against SHI-SRV-MIS overnight. Work out how it ended.
RDP and Shells
Saryarka Telecom JSC
The task is not to find an event but to write a rule that finds it on its own — without alerting on administrators' legitimate work.
From the Reader
Shipager Clinic
In the process-start log one parent-child pair appears where it should not, and on several workstations at once.
Records Walk Out
Shipager Clinic
In one day a single session carried more out of the network than all the other outbound traffic combined. Find it.
Records Round
Shipager Clinic
In the evening one account walked through a dozen network shares on SHI-SRV-FILE in a row. Find it and measure the reach.
Resolver Load
Zhetisu University
One workstation asked the resolver for hundreds of different names inside a single domain in one evening. Find it and measure the scale.
Route Sheet
Astana Logistik LLP
One workstation kept reaching the same external address all night at a fixed interval. Find it and work out what left the network.
Shift Change
Stepnoy Metall LLP
Monitoring flagged a spike of failed logons against STE-SRV-MES overnight. Work out how it ended.
Erased Shift
Stepnoy Metall LLP
The audit log on STE-SRV-MES was cleared in the evening. Reconstruct who did it and what they did there beforehand.
Silent Service
Saryarka Telecom JSC
Overnight a scheduled task and a new service appeared on SAR-SRV-BILL. Work out who created them and where they connected from.
Slow Crawl
Shipager Clinic
The site's daily log holds hundreds of 'not found' responses from a single address. Describe that client.
Slow Pulse
Korgan Insurance JSC
One workstation kept reaching the same external address all night at a fixed interval. Find it and work out what left the network.
Supplier Change
Mercur Retail LLP
A colleague forwarded a message saying it looks internal but feels wrong. Read the headers and tell them whether they are right.
Term Break
Zhetisu University
Overnight a scheduled task and a new service appeared on ZHE-SRV-LMS. Work out who created them and where they connected from.
Audit Gap
Korgan Insurance JSC
The audit log on KOR-SRV-CRM was cleared in the evening. Reconstruct who did it and what they did there beforehand.
Audit Sweep
Bereke Finance MFO
In the evening one account walked through a dozen network shares on BER-SRV-FILE in a row. Find it and measure the reach.
Audit Window
Bereke Finance MFO
Overnight a scheduled task and a new service appeared on BER-SRV-CORE. Work out who created them and where they connected from.
Browser Child
Zhetisu University
In the process-start log one parent-child pair appears where it should not, and on several workstations at once.
Quiet Claims
Korgan Insurance JSC
Overnight a scheduled task and a new service appeared on KOR-SRV-DOC. Work out who created them and where they connected from.
Clean Slate
Bereke Finance MFO
The audit log on BER-SRV-DOC was cleared in the evening. Reconstruct who did it and what they did there beforehand.
Closed Queue
Shipager Clinic
Three traces in different sources turn out to be one story: password guessing across many accounts from one address, a logon under the account that gave way, a sweep of network shares and a large transfer out from the same address.
Full Chain Rules
Stepnoy Metall LLP
The task is not to find an event but to write a rule that finds it on its own — without alerting on administrators' legitimate work.
Lab Results
Shipager Clinic
A colleague forwarded a message saying it looks internal but feels wrong. Read the headers and tell them whether they are right.
Late Desk
Korgan Insurance JSC
Three traces in different sources turn out to be one story: password guessing across many accounts from one address, a logon under the account that gave way, a sweep of network shares and a large transfer out from the same address.
Idle Line
Stepnoy Metall LLP
One workstation kept reaching the same external address all night at a fixed interval. Find it and work out what left the network.
Long Labels
Bereke Finance MFO
One workstation asked the resolver for hundreds of different names inside a single domain in one evening. Find it and measure the scale.
Payday
Bereke Finance MFO
Monitoring flagged a spike of failed logons against BER-SRV-CORE overnight. Work out how it ended.
Persistence Set
Bereke Finance MFO
The task is not to find an event but to write a rule that finds it on its own — without alerting on administrators' legitimate work.
Season Docs
Dala Agro LLP
In the evening one account walked through a dozen network shares on DAL-SRV-FILE in a row. Find it and measure the reach.
Subdomain Flood
Mercur Retail LLP
One workstation asked the resolver for hundreds of different names inside a single domain in one evening. Find it and measure the scale.
System Lookalike
Bereke Finance MFO
In the process-start log one parent-child pair appears where it should not, and on several workstations at once.
Tender File
Nur Integrator LLP
A colleague forwarded a message saying it looks internal but feels wrong. Read the headers and tell them whether they are right.
Ward Night
Shipager Clinic
One workstation kept reaching the same external address all night at a fixed interval. Find it and work out what left the network.