Dispatch Wave

Astana Logistik LLP is a logistics company. Two alerts fired overnight: a run of failed logons on the file server AL--SRV-FILE and a large data transfer out from a workstation. The on-duty analyst is not sure they are connected.

You need to check whether it is one story. There are two sources: the Windows event log (the file server and the domain controller AL--DC-01) and a day of connection records. What ties them together is not a name or a time but the workstation's address.

The set contains harmless look-alikes. A service account with a stale password produces steady failed logons, the nightly backup walks the same folders, and a legitimate large upload leaves during the day. Tell them apart by the number of distinct accounts, by the source and by the account — not by the night-time hour.

Fields: event.code (4624 for a logon, 4625 for a failed logon, 4776 for validation on the domain controller, 5145 for access to an object on a network share), user.name, source.ip, file.share, winlog.logon.id. On the Network tab, bytes out and bytes in are shown separately. Timestamps are UTC (Astana is UTC+5).