One Admin Too Many
Company: Astana Logistik LLP
Briefing
Astana Logistik LLP is a logistics company. The domain controller AL--DC-01 raised an alert: an account was added to a privileged group. Administrators do this regularly, so the alert alone settles nothing.
You need to work through the whole chain: when the account appeared, who created it, which group it was added to, and whether it was used afterwards. If it was used, the incident is no longer about permissions but about what was done.
The day's log also holds ordinary account operations — accounts are created for interns and contractors. Comparing against them is part of the task.
Artifacts
The same data as files for real tools: open in Wireshark or Excel, or load into Elastic. The answers match — it is the same data.
| @timestamp | event.code | host.name | user.name | source.ip | user.domain |
|---|---|---|---|---|---|
| 2026-02-25T04:25:50Z | 4624 | AL--WS-18 | s.isaeva | 10.20.1.49 | AL |
| 2026-02-25T04:31:47Z | 4624 | AL--WS-12 | r.tleubaev | 10.20.1.88 | AL |
| 2026-02-25T04:38:57Z | 4624 | AL--WS-21 | m.nurpeis | 10.20.1.37 | AL |
| 2026-02-25T04:59:15Z | 4624 | AL--WS-12 | r.tleubaev | 10.20.1.32 | AL |
| 2026-02-25T05:01:22Z | 4624 | AL--WS-32 | a.zhuma | 10.20.1.46 | AL |
| 2026-02-25T05:08:11Z | 4624 | AL--WS-59 | a.serik | 10.20.1.52 | AL |
| 2026-02-25T05:15:16Z | 4624 | AL--WS-12 | e.beketov | 10.20.1.117 | AL |
| 2026-02-25T05:30:00Z | 4720 | AL--DC-01 | a.zhuma | — | AL |
| 2026-02-25T05:47:10Z | 4624 | AL--WS-32 | a.zhuma | 10.20.1.108 | AL |
| 2026-02-25T06:19:44Z | 4624 | AL--WS-14 | d.abdrah | 10.20.1.53 | AL |
| 2026-02-25T06:23:01Z | 4624 | AL--WS-14 | d.abdrah | 10.20.1.59 | AL |
| 2026-02-25T06:27:37Z | 4625 | AL--WS-28 | t.kaliev | 10.20.1.92 | AL |
| 2026-02-25T06:29:37Z | 4624 | AL--WS-28 | t.kaliev | 10.20.1.92 | AL |
| 2026-02-25T06:36:27Z | 4624 | AL--WS-12 | e.beketov | 10.20.1.40 | AL |
| 2026-02-25T06:36:43Z | 4624 | AL--WS-59 | a.serik | 10.20.1.86 | AL |
| 2026-02-25T06:50:33Z | 4624 | AL--WS-28 | t.kaliev | 10.20.1.51 | AL |
| 2026-02-25T06:52:04Z | 4624 | AL--WS-12 | e.beketov | 10.20.1.48 | AL |
| 2026-02-25T07:03:30Z | 4625 | AL--WS-21 | m.nurpeis | 10.20.1.60 | AL |
| 2026-02-25T07:05:24Z | 4625 | AL--WS-21 | m.nurpeis | 10.20.1.89 | AL |
| 2026-02-25T07:06:30Z | 4624 | AL--WS-21 | m.nurpeis | 10.20.1.60 | AL |
| 2026-02-25T07:08:24Z | 4624 | AL--WS-21 | m.nurpeis | 10.20.1.89 | AL |
| 2026-02-25T07:10:00Z | 4720 | AL--DC-01 | a.zhuma | — | AL |
| 2026-02-25T07:14:00Z | 4732 | AL--DC-01 | a.zhuma | — | AL |
| 2026-02-25T07:18:09Z | 4624 | AL--WS-12 | e.beketov | 10.20.1.53 | AL |
| 2026-02-25T07:50:51Z | 4625 | AL--WS-32 | a.zhuma | 10.20.1.109 | AL |
| 2026-02-25T07:53:51Z | 4624 | AL--WS-32 | a.zhuma | 10.20.1.109 | AL |
| 2026-02-25T07:55:04Z | 4625 | AL--WS-14 | d.abdrah | 10.20.1.67 | AL |
| 2026-02-25T07:58:04Z | 4624 | AL--WS-14 | d.abdrah | 10.20.1.67 | AL |
| 2026-02-25T08:31:47Z | 4634 | AL--WS-12 | r.tleubaev | — | AL |
| 2026-02-25T08:38:33Z | 4624 | AL--WS-59 | a.serik | 10.20.1.99 | AL |
| 2026-02-25T08:38:57Z | 4634 | AL--WS-21 | m.nurpeis | — | AL |
| 2026-02-25T08:47:48Z | 4624 | AL--WS-12 | r.tleubaev | 10.20.1.90 | AL |
| 2026-02-25T08:57:29Z | 4624 | AL--WS-28 | t.kaliev | 10.20.1.43 | AL |
| 2026-02-25T09:42:37Z | 4624 | AL--WS-12 | e.beketov | 10.20.1.76 | AL |
| 2026-02-25T09:50:33Z | 4634 | AL--WS-28 | t.kaliev | — | AL |
| 2026-02-25T10:06:23Z | 4624 | AL--WS-59 | a.serik | 10.20.1.108 | AL |
| 2026-02-25T10:08:24Z | 4634 | AL--WS-21 | m.nurpeis | — | AL |
| 2026-02-25T10:21:25Z | 4624 | AL--WS-28 | t.kaliev | 10.20.1.31 | AL |
| 2026-02-25T10:41:00Z | 4624 | AL--WS-32 | a.zhuma | 10.20.1.56 | AL |
| 2026-02-25T10:47:10Z | 4634 | AL--WS-32 | a.zhuma | — | AL |
| 2026-02-25T10:52:04Z | 4634 | AL--WS-12 | e.beketov | — | AL |
| 2026-02-25T10:59:15Z | 4634 | AL--WS-12 | r.tleubaev | — | AL |
| 2026-02-25T11:01:22Z | 4634 | AL--WS-32 | a.zhuma | — | AL |
| 2026-02-25T11:05:15Z | 4624 | AL--WS-18 | s.isaeva | 10.20.1.97 | AL |
| 2026-02-25T11:10:26Z | 4624 | AL--WS-21 | m.nurpeis | 10.20.1.84 | AL |
| 2026-02-25T11:21:54Z | 4624 | AL--WS-12 | e.beketov | 10.20.1.108 | AL |
| 2026-02-25T11:23:01Z | 4634 | AL--WS-14 | d.abdrah | — | AL |
| 2026-02-25T11:25:50Z | 4634 | AL--WS-18 | s.isaeva | — | AL |
| 2026-02-25T11:36:27Z | 4634 | AL--WS-12 | e.beketov | — | AL |
| 2026-02-25T11:50:58Z | 4624 | AL--WS-18 | s.isaeva | 10.20.1.43 | AL |
| 2026-02-25T11:53:51Z | 4634 | AL--WS-32 | a.zhuma | — | AL |
| 2026-02-25T11:58:04Z | 4634 | AL--WS-14 | d.abdrah | — | AL |
| 2026-02-25T12:06:30Z | 4634 | AL--WS-21 | m.nurpeis | — | AL |
| 2026-02-25T12:08:11Z | 4634 | AL--WS-59 | a.serik | — | AL |
| 2026-02-25T12:16:40Z | 4624 | AL--WS-18 | s.isaeva | 10.20.1.53 | AL |
| 2026-02-25T12:19:44Z | 4634 | AL--WS-14 | d.abdrah | — | AL |
| 2026-02-25T12:33:27Z | 4624 | AL--WS-28 | t.kaliev | 10.20.1.80 | AL |
| 2026-02-25T12:36:30Z | 4625 | AL--WS-18 | s.isaeva | 10.20.1.95 | AL |
| 2026-02-25T12:37:30Z | 4624 | AL--WS-18 | s.isaeva | 10.20.1.95 | AL |
| 2026-02-25T12:45:22Z | 4625 | AL--WS-59 | a.serik | 10.20.1.39 | AL |
Questions
0/7 · 0/105 points
Log in to save your progress and appear on the leaderboard.
Which account was added to the privileged group?
Format: Account name · 15 points
Which group was it added to?
Format: Group name as it appears in the log · 15 points
Under which account was it created?
Format: Account name · 15 points
When was it created? UTC.
Format: YYYY-MM-DD HH:MM:SS · 20 points
When did that account first log on? UTC.
Format: YYYY-MM-DD HH:MM:SS · 20 points
Which host did it log on to?
Format: Host name · 10 points
Which MITRE ATT&CK technique covers changing account privileges for persistence?
Format: Identifier like T1234 · 10 points