Late Task
Company: Nur Integrator LLP
Briefing
Nur Integrator LLP is an IT services company. While reviewing logs in the morning, two overnight entries turned up on the server NUR-SRV-FILE: a scheduled task was created and a service was installed.
On their own these are routine: administrators create tasks and install services constantly, and the day's log holds several. What needs review is not the fact but the circumstances: at what hour, under which account, and where the logon came from.
You have the security log for the day. Timestamps are UTC; the office runs on Astana time (UTC+5), so the working day is roughly 04:00–13:00 UTC.
Artifacts
The same data as files for real tools: open in Wireshark or Excel, or load into Elastic. The answers match — it is the same data.
| @timestamp | event.code | host.name | user.name | source.ip | user.domain |
|---|---|---|---|---|---|
| 2026-02-10T02:05:00Z | 4624 | NUR-SRV-FILE | a.zhuma | 203.0.113.55 | NUR |
| 2026-02-10T02:14:00Z | 4698 | NUR-SRV-FILE | a.zhuma | — | NUR |
| 2026-02-10T02:20:00Z | 7045 | NUR-SRV-FILE | a.zhuma | — | — |
| 2026-02-10T04:38:48Z | 4624 | NUR-WS-54 | m.nurpeis | 10.90.8.48 | NUR |
| 2026-02-10T04:40:07Z | 4625 | NUR-WS-41 | t.kaliev | 10.90.8.98 | NUR |
| 2026-02-10T04:41:07Z | 4624 | NUR-WS-41 | t.kaliev | 10.90.8.98 | NUR |
| 2026-02-10T04:55:03Z | 4624 | NUR-WS-14 | s.isaeva | 10.90.8.120 | NUR |
| 2026-02-10T04:57:36Z | 4624 | NUR-WS-27 | e.beketov | 10.90.8.89 | NUR |
| 2026-02-10T05:04:20Z | 4624 | NUR-WS-41 | t.kaliev | 10.90.8.88 | NUR |
| 2026-02-10T05:20:47Z | 4624 | NUR-WS-46 | a.zhuma | 10.90.8.44 | NUR |
| 2026-02-10T05:22:06Z | 4624 | NUR-WS-14 | s.isaeva | 10.90.8.51 | NUR |
| 2026-02-10T05:25:39Z | 4625 | NUR-WS-54 | m.nurpeis | 10.90.8.105 | NUR |
| 2026-02-10T05:28:41Z | 4624 | NUR-WS-46 | a.zhuma | 10.90.8.73 | NUR |
| 2026-02-10T05:29:39Z | 4624 | NUR-WS-54 | m.nurpeis | 10.90.8.105 | NUR |
| 2026-02-10T06:12:00Z | 4698 | NUR-SRV-APP | a.zhuma | — | NUR |
| 2026-02-10T06:13:56Z | 4624 | NUR-WS-54 | m.nurpeis | 10.90.8.62 | NUR |
| 2026-02-10T06:17:15Z | 4624 | NUR-WS-54 | m.nurpeis | 10.90.8.56 | NUR |
| 2026-02-10T06:20:43Z | 4624 | NUR-WS-14 | s.isaeva | 10.90.8.114 | NUR |
| 2026-02-10T06:41:46Z | 4624 | NUR-WS-14 | s.isaeva | 10.90.8.38 | NUR |
| 2026-02-10T06:47:15Z | 4625 | NUR-WS-27 | e.beketov | 10.90.8.111 | NUR |
| 2026-02-10T06:51:15Z | 4624 | NUR-WS-27 | e.beketov | 10.90.8.111 | NUR |
| 2026-02-10T07:05:00Z | 7045 | NUR-SRV-APP | a.zhuma | — | — |
| 2026-02-10T07:15:33Z | 4625 | NUR-WS-41 | t.kaliev | 10.90.8.43 | NUR |
| 2026-02-10T07:15:35Z | 4624 | NUR-WS-17 | a.serik | 10.90.8.35 | NUR |
| 2026-02-10T07:17:33Z | 4624 | NUR-WS-41 | t.kaliev | 10.90.8.43 | NUR |
| 2026-02-10T07:31:48Z | 4624 | NUR-WS-23 | d.abdrah | 10.90.8.64 | NUR |
| 2026-02-10T07:41:07Z | 4634 | NUR-WS-41 | t.kaliev | — | NUR |
| 2026-02-10T08:01:31Z | 4624 | NUR-WS-17 | a.serik | 10.90.8.77 | NUR |
| 2026-02-10T08:14:56Z | 4624 | NUR-WS-39 | r.tleubaev | 10.90.8.39 | NUR |
| 2026-02-10T08:22:30Z | 4624 | NUR-WS-39 | r.tleubaev | 10.90.8.106 | NUR |
| 2026-02-10T08:32:31Z | 4624 | NUR-WS-17 | a.serik | 10.90.8.45 | NUR |
| 2026-02-10T08:40:00Z | 4698 | NUR-DC-01 | a.zhuma | — | NUR |
| 2026-02-10T08:50:15Z | 4624 | NUR-WS-54 | m.nurpeis | 10.90.8.79 | NUR |
| 2026-02-10T09:13:56Z | 4634 | NUR-WS-54 | m.nurpeis | — | NUR |
| 2026-02-10T09:20:43Z | 4634 | NUR-WS-14 | s.isaeva | — | NUR |
| 2026-02-10T09:29:39Z | 4634 | NUR-WS-54 | m.nurpeis | — | NUR |
| 2026-02-10T09:34:57Z | 4624 | NUR-WS-41 | t.kaliev | 10.90.8.68 | NUR |
| 2026-02-10T09:38:47Z | 4624 | NUR-WS-41 | t.kaliev | 10.90.8.96 | NUR |
| 2026-02-10T09:42:23Z | 4625 | NUR-WS-41 | t.kaliev | 10.90.8.42 | NUR |
| 2026-02-10T09:42:40Z | 4624 | NUR-WS-39 | r.tleubaev | 10.90.8.33 | NUR |
| 2026-02-10T09:44:23Z | 4624 | NUR-WS-41 | t.kaliev | 10.90.8.42 | NUR |
| 2026-02-10T09:57:36Z | 4634 | NUR-WS-27 | e.beketov | — | NUR |
| 2026-02-10T10:02:35Z | 4624 | NUR-WS-54 | m.nurpeis | 10.90.8.112 | NUR |
| 2026-02-10T10:04:20Z | 4634 | NUR-WS-41 | t.kaliev | — | NUR |
| 2026-02-10T10:18:56Z | 4624 | NUR-WS-17 | a.serik | 10.90.8.71 | NUR |
| 2026-02-10T10:19:08Z | 4624 | NUR-WS-14 | s.isaeva | 10.90.8.80 | NUR |
| 2026-02-10T10:38:48Z | 4634 | NUR-WS-54 | m.nurpeis | — | NUR |
| 2026-02-10T11:08:40Z | 4624 | NUR-WS-54 | m.nurpeis | 10.90.8.112 | NUR |
| 2026-02-10T11:15:35Z | 4634 | NUR-WS-17 | a.serik | — | NUR |
| 2026-02-10T11:20:47Z | 4634 | NUR-WS-46 | a.zhuma | — | NUR |
| 2026-02-10T11:22:06Z | 4634 | NUR-WS-14 | s.isaeva | — | NUR |
| 2026-02-10T11:24:48Z | 4624 | NUR-WS-41 | t.kaliev | 10.90.8.69 | NUR |
| 2026-02-10T11:31:48Z | 4634 | NUR-WS-23 | d.abdrah | — | NUR |
| 2026-02-10T11:32:44Z | 4624 | NUR-WS-41 | t.kaliev | 10.90.8.84 | NUR |
| 2026-02-10T12:06:13Z | 4625 | NUR-WS-54 | m.nurpeis | 10.90.8.54 | NUR |
| 2026-02-10T12:10:13Z | 4624 | NUR-WS-54 | m.nurpeis | 10.90.8.54 | NUR |
| 2026-02-10T12:14:56Z | 4634 | NUR-WS-39 | r.tleubaev | — | NUR |
| 2026-02-10T12:21:11Z | 4624 | NUR-WS-14 | s.isaeva | 10.90.8.95 | NUR |
| 2026-02-10T12:22:48Z | 4624 | NUR-WS-14 | s.isaeva | 10.90.8.60 | NUR |
| 2026-02-10T12:27:37Z | 4625 | NUR-WS-17 | a.serik | 10.90.8.103 | NUR |
Questions
0/7 · 0/110 points
Log in to save your progress and appear on the leaderboard.
What is the name of the scheduled task created overnight?
Format: Task name as it appears in the log · 15 points
When was it created? UTC.
Format: YYYY-MM-DD HH:MM:SS · 20 points
Under which account was it created?
Format: Account name · 15 points
On which host did this happen?
Format: Host name as it appears in the log · 10 points
Which service was installed next?
Format: Service name · 20 points
Which file does that service run from?
Format: Full file path · 20 points
Which MITRE ATT&CK technique covers persistence through a scheduled task?
Format: Identifier like T1234.005 · 10 points