Erased Evening
Company: Altyn Stroy LLP
Briefing
Altyn Stroy LLP is a construction company. Monitoring sent a single event: the audit log on the server ALT-SRV-FILE was cleared. The alert says nothing else.
The clearing event itself cannot be deleted — it is written into the new, empty log. That is your starting point: it carries the time, the host and the account. The rest is reconstructed from what survived: some of that account's records reached the log before the wipe.
Timestamps are UTC; the office runs on Astana time (UTC+5), so the working day is roughly 04:00–13:00 UTC.
Artifacts
The same data as files for real tools: open in Wireshark or Excel, or load into Elastic. The answers match — it is the same data.
| @timestamp | event.code | host.name | user.name | source.ip | user.domain |
|---|---|---|---|---|---|
| 2026-02-26T04:09:38Z | 4624 | ALT-WS-33 | s.isaeva | 10.40.2.42 | ALT |
| 2026-02-26T04:12:05Z | 4624 | ALT-WS-29 | e.beketov | 10.40.2.77 | ALT |
| 2026-02-26T04:15:54Z | 4624 | ALT-WS-21 | t.kaliev | 10.40.2.109 | ALT |
| 2026-02-26T04:27:24Z | 4624 | ALT-WS-33 | s.isaeva | 10.40.2.57 | ALT |
| 2026-02-26T04:47:10Z | 4624 | ALT-WS-29 | e.beketov | 10.40.2.74 | ALT |
| 2026-02-26T05:37:00Z | 4625 | ALT-WS-15 | a.zhuma | 10.40.2.63 | ALT |
| 2026-02-26T05:41:00Z | 4624 | ALT-WS-15 | a.zhuma | 10.40.2.63 | ALT |
| 2026-02-26T05:42:45Z | 4624 | ALT-WS-29 | e.beketov | 10.40.2.64 | ALT |
| 2026-02-26T05:57:06Z | 4624 | ALT-WS-55 | d.abdrah | 10.40.2.53 | ALT |
| 2026-02-26T06:06:48Z | 4624 | ALT-WS-50 | m.nurpeis | 10.40.2.80 | ALT |
| 2026-02-26T06:22:21Z | 4624 | ALT-WS-29 | e.beketov | 10.40.2.46 | ALT |
| 2026-02-26T06:53:23Z | 4624 | ALT-WS-55 | d.abdrah | 10.40.2.108 | ALT |
| 2026-02-26T07:01:31Z | 4624 | ALT-WS-15 | a.zhuma | 10.40.2.40 | ALT |
| 2026-02-26T07:08:26Z | 4624 | ALT-WS-33 | s.isaeva | 10.40.2.89 | ALT |
| 2026-02-26T07:15:52Z | 4624 | ALT-WS-29 | e.beketov | 10.40.2.71 | ALT |
| 2026-02-26T07:18:38Z | 4624 | ALT-WS-50 | m.nurpeis | 10.40.2.90 | ALT |
| 2026-02-26T07:42:14Z | 4624 | ALT-WS-12 | a.serik | 10.40.2.69 | ALT |
| 2026-02-26T07:42:20Z | 4624 | ALT-WS-29 | e.beketov | 10.40.2.76 | ALT |
| 2026-02-26T07:50:20Z | 4624 | ALT-WS-41 | r.tleubaev | 10.40.2.63 | ALT |
| 2026-02-26T08:21:53Z | 4625 | ALT-WS-29 | e.beketov | 10.40.2.116 | ALT |
| 2026-02-26T08:22:53Z | 4624 | ALT-WS-29 | e.beketov | 10.40.2.116 | ALT |
| 2026-02-26T08:27:24Z | 4634 | ALT-WS-33 | s.isaeva | — | ALT |
| 2026-02-26T08:34:50Z | 4624 | ALT-WS-21 | t.kaliev | 10.40.2.108 | ALT |
| 2026-02-26T08:42:45Z | 4634 | ALT-WS-29 | e.beketov | — | ALT |
| 2026-02-26T08:42:50Z | 4624 | ALT-WS-50 | m.nurpeis | 10.40.2.100 | ALT |
| 2026-02-26T08:47:19Z | 4624 | ALT-WS-33 | s.isaeva | 10.40.2.74 | ALT |
| 2026-02-26T08:59:54Z | 4625 | ALT-WS-50 | m.nurpeis | 10.40.2.73 | ALT |
| 2026-02-26T09:00:54Z | 4624 | ALT-WS-50 | m.nurpeis | 10.40.2.73 | ALT |
| 2026-02-26T09:09:38Z | 4634 | ALT-WS-33 | s.isaeva | — | ALT |
| 2026-02-26T09:18:43Z | 4624 | ALT-WS-12 | a.serik | 10.40.2.113 | ALT |
| 2026-02-26T09:20:16Z | 4624 | ALT-WS-29 | e.beketov | 10.40.2.116 | ALT |
| 2026-02-26T09:20:18Z | 4624 | ALT-WS-12 | a.serik | 10.40.2.36 | ALT |
| 2026-02-26T09:26:03Z | 4624 | ALT-WS-41 | r.tleubaev | 10.40.2.56 | ALT |
| 2026-02-26T09:44:38Z | 4624 | ALT-WS-41 | r.tleubaev | 10.40.2.39 | ALT |
| 2026-02-26T09:52:38Z | 4624 | ALT-WS-50 | m.nurpeis | 10.40.2.37 | ALT |
| 2026-02-26T10:31:33Z | 4624 | ALT-WS-33 | s.isaeva | 10.40.2.34 | ALT |
| 2026-02-26T10:41:00Z | 4634 | ALT-WS-15 | a.zhuma | — | ALT |
| 2026-02-26T10:43:54Z | 4624 | ALT-WS-41 | r.tleubaev | 10.40.2.113 | ALT |
| 2026-02-26T10:45:18Z | 4624 | ALT-WS-21 | t.kaliev | 10.40.2.107 | ALT |
| 2026-02-26T10:46:24Z | 4624 | ALT-WS-41 | r.tleubaev | 10.40.2.103 | ALT |
| 2026-02-26T10:57:06Z | 4634 | ALT-WS-55 | d.abdrah | — | ALT |
| 2026-02-26T10:59:15Z | 4624 | ALT-WS-15 | a.zhuma | 10.40.2.87 | ALT |
| 2026-02-26T11:15:54Z | 4634 | ALT-WS-21 | t.kaliev | — | ALT |
| 2026-02-26T11:22:21Z | 4634 | ALT-WS-29 | e.beketov | — | ALT |
| 2026-02-26T11:25:27Z | 4625 | ALT-WS-21 | t.kaliev | 10.40.2.62 | ALT |
| 2026-02-26T11:27:27Z | 4624 | ALT-WS-21 | t.kaliev | 10.40.2.62 | ALT |
| 2026-02-26T11:31:19Z | 4625 | ALT-WS-29 | e.beketov | 10.40.2.31 | ALT |
| 2026-02-26T11:34:19Z | 4624 | ALT-WS-29 | e.beketov | 10.40.2.31 | ALT |
| 2026-02-26T11:36:42Z | 4625 | ALT-WS-21 | t.kaliev | 10.40.2.47 | ALT |
| 2026-02-26T11:40:42Z | 4624 | ALT-WS-21 | t.kaliev | 10.40.2.47 | ALT |
| 2026-02-26T12:08:26Z | 4634 | ALT-WS-33 | s.isaeva | — | ALT |
| 2026-02-26T12:12:05Z | 4634 | ALT-WS-29 | e.beketov | — | ALT |
| 2026-02-26T12:12:56Z | 4624 | ALT-WS-50 | m.nurpeis | 10.40.2.56 | ALT |
| 2026-02-26T12:15:52Z | 4634 | ALT-WS-29 | e.beketov | — | ALT |
| 2026-02-26T12:19:56Z | 4624 | ALT-WS-15 | a.zhuma | 10.40.2.37 | ALT |
| 2026-02-26T12:33:00Z | 4624 | ALT-WS-50 | m.nurpeis | 10.40.2.100 | ALT |
| 2026-02-26T12:42:14Z | 4634 | ALT-WS-12 | a.serik | — | ALT |
| 2026-02-26T12:47:10Z | 4634 | ALT-WS-29 | e.beketov | — | ALT |
| 2026-02-26T12:50:20Z | 4634 | ALT-WS-41 | r.tleubaev | — | ALT |
| 2026-02-26T13:01:31Z | 4634 | ALT-WS-15 | a.zhuma | — | ALT |
Questions
0/7 · 0/110 points
Log in to save your progress and appear on the leaderboard.
When was the audit log cleared? UTC.
Format: YYYY-MM-DD HH:MM:SS · 20 points
Under which account was the log cleared?
Format: Account name · 15 points
On which host did this happen?
Format: Host name · 10 points
Which address did that account log on from?
Format: IPv4 address · 15 points
How many events from that account reached the log before the wipe?
Format: Whole number · 20 points
Which network share did that account access first?
Format: A network path like \\SERVER\Folder · 20 points
Which MITRE ATT&CK technique covers clearing Windows event logs?
Format: Identifier like T1234.001 · 10 points