Threat HuntingMediumPro

Archive Tour

Company: Zhetisu University

40 min7 questions100 pointsMITRE ATT&CK:T1135T1078

Briefing

Zhetisu University is a regional higher-education institution. The file server ZHE-SRV-FILE has share access auditing enabled. Yesterday's log has accumulated, and something in it is off.

During the day the picture is ordinary: staff open their own department folders, one or two each. You are after the account that behaved differently — methodically, one folder at a time, outside the working day.

Share access is event 5140. The path is in file.share, the accessing address in source.ip. Timestamps are UTC.

This lab is part of the subscription

Get Pro to unlock every lab, the tracks and new material each month.

See pricing