← Labs
Threat HuntingMediumPro

Holiday Logon

Company: Bereke Finance MFO

35 min7 questions100 pointsMITRE ATT&CK:T1078T1133

Briefing

Bereke Finance MFO is a microfinance company. A monitoring rule fired on a successful logon outside the working day. A successful logon is neither an error nor a denial, so the alert by itself proves nothing.

Your task is to decide whether this logon departs from the account's usual behaviour. The log also contains its daytime logons: look at where it normally connects from and to.

The office working day is roughly 04:00–13:00 UTC (09:00–18:00 Astana time). Timestamps are UTC.

This lab is part of the subscription

Get Pro to unlock every lab, the tracks and new material each month.

See pricing
Holiday Logon · KAI Defenders