← Labs
Threat HuntingEasyPro

Remote from the Field

Company: Dala Agro LLP

35 min7 questions100 pointsMITRE ATT&CK:T1078T1133

Briefing

Dala Agro LLP is an agricultural holding. A monitoring rule fired on a successful logon outside the working day. A successful logon is neither an error nor a denial, so the alert by itself proves nothing.

Your task is to decide whether this logon departs from the account's usual behaviour. The log also contains its daytime logons: look at where it normally connects from and to.

The office working day is roughly 04:00–13:00 UTC (09:00–18:00 Astana time). Timestamps are UTC.

This lab is part of the subscription

Get Pro to unlock every lab, the tracks and new material each month.

See pricing
Remote from the Field · KAI Defenders