After Eight
Company: Astana Logistik LLP
Briefing
Astana Logistik LLP is a logistics company. A monitoring rule fired on a successful logon outside the working day. A successful logon is neither an error nor a denial, so the alert by itself proves nothing.
Your task is to decide whether this logon departs from the account's usual behaviour. The log also contains its daytime logons: look at where it normally connects from and to.
The office working day is roughly 04:00–13:00 UTC (09:00–18:00 Astana time). Timestamps are UTC.
Artifacts
The same data as files for real tools: open in Wireshark or Excel, or load into Elastic. The answers match — it is the same data.
| @timestamp | event.code | host.name | user.name | source.ip | user.domain |
|---|---|---|---|---|---|
| 2026-02-04T04:15:54Z | 4624 | AL--WS-14 | t.kaliev | 10.20.1.40 | AL |
| 2026-02-04T04:35:27Z | 4624 | AL--WS-60 | s.isaeva | 10.20.1.71 | AL |
| 2026-02-04T05:10:00Z | 4624 | AL--WS-48 | a.serik | 10.20.1.40 | AL |
| 2026-02-04T05:12:12Z | 4624 | AL--WS-48 | a.serik | 10.20.1.82 | AL |
| 2026-02-04T05:14:04Z | 4624 | AL--WS-28 | m.nurpeis | 10.20.1.103 | AL |
| 2026-02-04T05:15:05Z | 4625 | AL--WS-43 | e.beketov | 10.20.1.49 | AL |
| 2026-02-04T05:17:05Z | 4624 | AL--WS-43 | e.beketov | 10.20.1.49 | AL |
| 2026-02-04T05:29:31Z | 4624 | AL--WS-48 | a.serik | 10.20.1.91 | AL |
| 2026-02-04T05:39:41Z | 4625 | AL--WS-47 | d.abdrah | 10.20.1.82 | AL |
| 2026-02-04T05:43:41Z | 4624 | AL--WS-47 | d.abdrah | 10.20.1.82 | AL |
| 2026-02-04T05:47:46Z | 4624 | AL--WS-24 | a.zhuma | 10.20.1.38 | AL |
| 2026-02-04T05:48:28Z | 4625 | AL--WS-47 | d.abdrah | 10.20.1.62 | AL |
| 2026-02-04T05:51:28Z | 4624 | AL--WS-47 | d.abdrah | 10.20.1.62 | AL |
| 2026-02-04T05:55:00Z | 4634 | AL--WS-48 | a.serik | — | AL |
| 2026-02-04T06:01:21Z | 4624 | AL--WS-34 | r.tleubaev | 10.20.1.99 | AL |
| 2026-02-04T06:10:00Z | 4624 | AL--WS-48 | a.serik | 10.20.1.41 | AL |
| 2026-02-04T06:39:45Z | 4625 | AL--WS-28 | m.nurpeis | 10.20.1.112 | AL |
| 2026-02-04T06:40:45Z | 4624 | AL--WS-28 | m.nurpeis | 10.20.1.112 | AL |
| 2026-02-04T06:55:00Z | 4634 | AL--WS-48 | a.serik | — | AL |
| 2026-02-04T07:03:20Z | 4624 | AL--WS-24 | a.zhuma | 10.20.1.44 | AL |
| 2026-02-04T07:10:00Z | 4624 | AL--WS-48 | a.serik | 10.20.1.42 | AL |
| 2026-02-04T07:15:54Z | 4634 | AL--WS-14 | t.kaliev | — | AL |
| 2026-02-04T07:21:41Z | 4625 | AL--WS-14 | t.kaliev | 10.20.1.114 | AL |
| 2026-02-04T07:22:49Z | 4624 | AL--WS-47 | d.abdrah | 10.20.1.34 | AL |
| 2026-02-04T07:24:41Z | 4624 | AL--WS-14 | t.kaliev | 10.20.1.114 | AL |
| 2026-02-04T07:29:18Z | 4624 | AL--WS-34 | r.tleubaev | 10.20.1.118 | AL |
| 2026-02-04T07:35:27Z | 4634 | AL--WS-60 | s.isaeva | — | AL |
| 2026-02-04T07:55:00Z | 4634 | AL--WS-48 | a.serik | — | AL |
| 2026-02-04T07:58:39Z | 4624 | AL--WS-43 | e.beketov | 10.20.1.74 | AL |
| 2026-02-04T08:10:00Z | 4624 | AL--WS-48 | a.serik | 10.20.1.43 | AL |
| 2026-02-04T08:17:19Z | 4624 | AL--WS-48 | a.serik | 10.20.1.116 | AL |
| 2026-02-04T08:20:40Z | 4625 | AL--WS-47 | d.abdrah | 10.20.1.96 | AL |
| 2026-02-04T08:22:40Z | 4624 | AL--WS-47 | d.abdrah | 10.20.1.96 | AL |
| 2026-02-04T08:25:05Z | 4624 | AL--WS-24 | a.zhuma | 10.20.1.117 | AL |
| 2026-02-04T08:27:45Z | 4624 | AL--WS-60 | s.isaeva | 10.20.1.67 | AL |
| 2026-02-04T08:34:43Z | 4624 | AL--WS-24 | a.zhuma | 10.20.1.81 | AL |
| 2026-02-04T08:37:57Z | 4624 | AL--WS-48 | a.serik | 10.20.1.42 | AL |
| 2026-02-04T08:51:28Z | 4634 | AL--WS-47 | d.abdrah | — | AL |
| 2026-02-04T08:55:00Z | 4634 | AL--WS-48 | a.serik | — | AL |
| 2026-02-04T09:14:04Z | 4634 | AL--WS-28 | m.nurpeis | — | AL |
| 2026-02-04T09:21:39Z | 4625 | AL--WS-60 | s.isaeva | 10.20.1.111 | AL |
| 2026-02-04T09:24:39Z | 4624 | AL--WS-60 | s.isaeva | 10.20.1.111 | AL |
| 2026-02-04T09:29:37Z | 4624 | AL--WS-47 | d.abdrah | 10.20.1.108 | AL |
| 2026-02-04T09:43:41Z | 4634 | AL--WS-47 | d.abdrah | — | AL |
| 2026-02-04T09:46:45Z | 4624 | AL--WS-34 | r.tleubaev | 10.20.1.91 | AL |
| 2026-02-04T09:50:19Z | 4624 | AL--WS-47 | d.abdrah | 10.20.1.106 | AL |
| 2026-02-04T09:57:04Z | 4624 | AL--WS-48 | a.serik | 10.20.1.118 | AL |
| 2026-02-04T10:02:18Z | 4624 | AL--WS-60 | s.isaeva | 10.20.1.51 | AL |
| 2026-02-04T10:08:20Z | 4624 | AL--WS-34 | r.tleubaev | 10.20.1.115 | AL |
| 2026-02-04T10:12:12Z | 4634 | AL--WS-48 | a.serik | — | AL |
| 2026-02-04T10:12:32Z | 4624 | AL--WS-60 | s.isaeva | 10.20.1.42 | AL |
| 2026-02-04T10:22:49Z | 4634 | AL--WS-47 | d.abdrah | — | AL |
| 2026-02-04T10:25:35Z | 4624 | AL--WS-48 | a.serik | 10.20.1.99 | AL |
| 2026-02-04T10:29:18Z | 4634 | AL--WS-34 | r.tleubaev | — | AL |
| 2026-02-04T10:51:48Z | 4624 | AL--WS-47 | d.abdrah | 10.20.1.36 | AL |
| 2026-02-04T10:58:39Z | 4634 | AL--WS-43 | e.beketov | — | AL |
| 2026-02-04T11:01:21Z | 4634 | AL--WS-34 | r.tleubaev | — | AL |
| 2026-02-04T11:03:20Z | 4634 | AL--WS-24 | a.zhuma | — | AL |
| 2026-02-04T11:28:01Z | 4625 | AL--WS-28 | m.nurpeis | 10.20.1.42 | AL |
| 2026-02-04T11:31:01Z | 4624 | AL--WS-28 | m.nurpeis | 10.20.1.42 | AL |
Questions
0/7 · 0/100 points
Log in to save your progress and appear on the leaderboard.
Which account logged on during the evening?
Format: Account name · 15 points
Which address were those logons from?
Format: IPv4 address · 15 points
How many successful logons by that account happened outside the working day?
Format: Whole number · 20 points
When was the first such logon? UTC.
Format: YYYY-MM-DD HH:MM:SS · 20 points
Which host did it log on to?
Format: Host name · 10 points
Which logon type was used in the evening?
Format: Number: 2 local, 3 network, 10 remote desktop · 10 points
Which MITRE ATT&CK technique covers operating under a legitimate account?
Format: Identifier like T1234 · 10 points