Night Shift
Company: Astana Logistik LLP
Briefing
You are a tier-one analyst. Astana Logistik LLP is a logistics company. In the morning an alert arrives: the server AL--SRV-APP recorded an unusual number of failed logons during the night.
People mistype passwords every day and most such spikes are not incidents. Your job is to decide whether this one is, and if so to reconstruct the sequence: where the attempts came from, when they stopped and what happened next.
You have the security log for the day. Timestamps are UTC; the office runs on Astana time (UTC+5).
Artifacts
The same data as files for real tools: open in Wireshark or Excel, or load into Elastic. The answers match — it is the same data.
| @timestamp | event.code | host.name | user.name | source.ip | user.domain |
|---|---|---|---|---|---|
| 2026-09-14T04:04:41Z | 4624 | AL--WS-26 | e.beketov | 10.20.1.59 | AL |
| 2026-09-14T04:18:20Z | 4625 | AL--WS-56 | r.tleubaev | 10.20.1.42 | AL |
| 2026-09-14T04:19:20Z | 4624 | AL--WS-56 | r.tleubaev | 10.20.1.42 | AL |
| 2026-09-14T04:25:01Z | 4625 | AL--WS-26 | e.beketov | 10.20.1.66 | AL |
| 2026-09-14T04:27:01Z | 4624 | AL--WS-26 | e.beketov | 10.20.1.66 | AL |
| 2026-09-14T04:47:00Z | 4624 | AL--WS-38 | a.zhuma | 10.20.1.80 | AL |
| 2026-09-14T04:49:38Z | 4624 | AL--WS-23 | m.nurpeis | 10.20.1.90 | AL |
| 2026-09-14T05:02:43Z | 4624 | AL--WS-35 | d.abdrah | 10.20.1.64 | AL |
| 2026-09-14T05:03:55Z | 4624 | AL--WS-56 | r.tleubaev | 10.20.1.32 | AL |
| 2026-09-14T05:06:16Z | 4624 | AL--WS-38 | a.zhuma | 10.20.1.104 | AL |
| 2026-09-14T05:17:26Z | 4625 | AL--WS-29 | a.serik | 10.20.1.77 | AL |
| 2026-09-14T05:19:26Z | 4624 | AL--WS-29 | a.serik | 10.20.1.77 | AL |
| 2026-09-14T06:20:25Z | 4625 | AL--WS-14 | t.kaliev | 10.20.1.106 | AL |
| 2026-09-14T06:20:25Z | 4625 | AL--WS-14 | t.kaliev | 10.20.1.117 | AL |
| 2026-09-14T06:23:25Z | 4624 | AL--WS-14 | t.kaliev | 10.20.1.106 | AL |
| 2026-09-14T06:23:25Z | 4624 | AL--WS-14 | t.kaliev | 10.20.1.117 | AL |
| 2026-09-14T06:23:26Z | 4624 | AL--WS-26 | e.beketov | 10.20.1.94 | AL |
| 2026-09-14T06:43:15Z | 4624 | AL--WS-23 | m.nurpeis | 10.20.1.51 | AL |
| 2026-09-14T07:00:19Z | 4625 | AL--WS-23 | m.nurpeis | 10.20.1.59 | AL |
| 2026-09-14T07:02:19Z | 4624 | AL--WS-23 | m.nurpeis | 10.20.1.59 | AL |
| 2026-09-14T07:04:46Z | 4624 | AL--WS-35 | d.abdrah | 10.20.1.115 | AL |
| 2026-09-14T07:15:51Z | 4624 | AL--WS-56 | r.tleubaev | 10.20.1.47 | AL |
| 2026-09-14T07:34:36Z | 4624 | AL--WS-29 | a.serik | 10.20.1.79 | AL |
| 2026-09-14T07:49:35Z | 4624 | AL--WS-23 | m.nurpeis | 10.20.1.92 | AL |
| 2026-09-14T07:51:34Z | 4624 | AL--WS-29 | a.serik | 10.20.1.36 | AL |
| 2026-09-14T08:02:43Z | 4634 | AL--WS-35 | d.abdrah | — | AL |
| 2026-09-14T08:09:40Z | 4624 | AL--WS-14 | t.kaliev | 10.20.1.105 | AL |
| 2026-09-14T08:22:06Z | 4624 | AL--WS-35 | d.abdrah | 10.20.1.105 | AL |
| 2026-09-14T08:27:29Z | 4624 | AL--WS-35 | d.abdrah | 10.20.1.32 | AL |
| 2026-09-14T08:31:29Z | 4624 | AL--WS-26 | e.beketov | 10.20.1.50 | AL |
| 2026-09-14T08:47:30Z | 4625 | AL--WS-38 | a.zhuma | 10.20.1.31 | AL |
| 2026-09-14T08:48:30Z | 4624 | AL--WS-38 | a.zhuma | 10.20.1.31 | AL |
| 2026-09-14T08:51:29Z | 4624 | AL--WS-38 | a.zhuma | 10.20.1.31 | AL |
| 2026-09-14T08:54:21Z | 4625 | AL--WS-29 | a.serik | 10.20.1.52 | AL |
| 2026-09-14T08:57:21Z | 4624 | AL--WS-29 | a.serik | 10.20.1.52 | AL |
| 2026-09-14T09:04:41Z | 4634 | AL--WS-26 | e.beketov | — | AL |
| 2026-09-14T09:06:09Z | 4624 | AL--WS-23 | m.nurpeis | 10.20.1.95 | AL |
| 2026-09-14T09:06:16Z | 4634 | AL--WS-38 | a.zhuma | — | AL |
| 2026-09-14T09:19:26Z | 4634 | AL--WS-29 | a.serik | — | AL |
| 2026-09-14T09:46:53Z | 4624 | AL--WS-56 | r.tleubaev | 10.20.1.87 | AL |
| 2026-09-14T09:59:02Z | 4624 | AL--WS-14 | t.kaliev | 10.20.1.67 | AL |
| 2026-09-14T10:01:26Z | 4624 | AL--WS-14 | t.kaliev | 10.20.1.89 | AL |
| 2026-09-14T10:02:19Z | 4634 | AL--WS-23 | m.nurpeis | — | AL |
| 2026-09-14T10:04:46Z | 4634 | AL--WS-35 | d.abdrah | — | AL |
| 2026-09-14T10:05:19Z | 4624 | AL--WS-38 | a.zhuma | 10.20.1.117 | AL |
| 2026-09-14T10:16:51Z | 4624 | AL--WS-38 | a.zhuma | 10.20.1.94 | AL |
| 2026-09-14T10:27:01Z | 4634 | AL--WS-26 | e.beketov | — | AL |
| 2026-09-14T10:28:51Z | 4624 | AL--WS-56 | r.tleubaev | 10.20.1.57 | AL |
| 2026-09-14T10:29:13Z | 4624 | AL--WS-23 | m.nurpeis | 10.20.1.87 | AL |
| 2026-09-14T10:49:38Z | 4634 | AL--WS-23 | m.nurpeis | — | AL |
| 2026-09-14T10:54:42Z | 4625 | AL--WS-23 | m.nurpeis | 10.20.1.44 | AL |
| 2026-09-14T10:57:01Z | 4624 | AL--WS-56 | r.tleubaev | 10.20.1.39 | AL |
| 2026-09-14T10:57:42Z | 4624 | AL--WS-23 | m.nurpeis | 10.20.1.44 | AL |
| 2026-09-14T11:07:50Z | 4624 | AL--WS-29 | a.serik | 10.20.1.119 | AL |
| 2026-09-14T11:11:40Z | 4624 | AL--WS-23 | s.isaeva | 10.20.1.37 | AL |
| 2026-09-14T11:19:20Z | 4634 | AL--WS-56 | r.tleubaev | — | AL |
| 2026-09-14T11:19:22Z | 4624 | AL--WS-38 | a.zhuma | 10.20.1.79 | AL |
| 2026-09-14T11:23:25Z | 4634 | AL--WS-14 | t.kaliev | — | AL |
| 2026-09-14T11:47:00Z | 4634 | AL--WS-38 | a.zhuma | — | AL |
| 2026-09-14T11:49:35Z | 4634 | AL--WS-23 | m.nurpeis | — | AL |
Questions
0/7 · 0/100 points
Log in to save your progress and appear on the leaderboard.
Which external address did the failed logons come from?
Format: IPv4 address, e.g. 198.51.100.10 · 10 points
How many failed logons came from that address?
Format: Whole number · 15 points
Which account finally logged on successfully from that address?
Format: Account name as it appears in the log · 15 points
When did that successful logon happen? UTC.
Format: YYYY-MM-DD HH:MM:SS · 20 points
Which logon type was used?
Format: Number: 2 local, 3 network, 10 remote desktop · 10 points
Which account was created after the logon?
Format: Account name · 20 points
Which MITRE ATT&CK technique covers password guessing?
Format: Identifier like T1234 · 10 points