Open Doors
Company: Altyn Stroy LLP
Briefing
Altyn Stroy LLP is a construction company. The file server ALT-SRV-FILE has share access auditing enabled. Yesterday's log has accumulated, and something in it is off.
During the day the picture is ordinary: staff open their own department folders, one or two each. You are after the account that behaved differently — methodically, one folder at a time, outside the working day.
Share access is event 5140. The path is in file.share, the accessing address in source.ip. Timestamps are UTC.
Artifacts
The same data as files for real tools: open in Wireshark or Excel, or load into Elastic. The answers match — it is the same data.
| @timestamp | event.code | host.name | user.name | source.ip | user.domain |
|---|---|---|---|---|---|
| 2026-02-11T04:05:15Z | 5140 | ALT-SRV-FILE | r.tleubaev | 10.40.2.59 | ALT |
| 2026-02-11T04:07:24Z | 4624 | ALT-WS-23 | r.tleubaev | 10.40.2.34 | ALT |
| 2026-02-11T04:08:14Z | 5140 | ALT-SRV-FILE | a.serik | 10.40.2.36 | ALT |
| 2026-02-11T04:08:55Z | 5140 | ALT-SRV-FILE | a.zhuma | 10.40.2.114 | ALT |
| 2026-02-11T04:10:35Z | 4625 | ALT-WS-29 | s.isaeva | 10.40.2.99 | ALT |
| 2026-02-11T04:13:16Z | 5140 | ALT-SRV-FILE | t.kaliev | 10.40.2.32 | ALT |
| 2026-02-11T04:13:35Z | 4624 | ALT-WS-29 | s.isaeva | 10.40.2.99 | ALT |
| 2026-02-11T04:18:06Z | 4625 | ALT-WS-29 | t.kaliev | 10.40.2.102 | ALT |
| 2026-02-11T04:19:06Z | 4624 | ALT-WS-29 | t.kaliev | 10.40.2.102 | ALT |
| 2026-02-11T04:21:02Z | 4624 | ALT-WS-37 | m.nurpeis | 10.40.2.108 | ALT |
| 2026-02-11T04:27:40Z | 5140 | ALT-SRV-FILE | e.beketov | 10.40.2.65 | ALT |
| 2026-02-11T04:37:59Z | 4624 | ALT-WS-23 | r.tleubaev | 10.40.2.114 | ALT |
| 2026-02-11T04:42:43Z | 4625 | ALT-WS-18 | a.zhuma | 10.40.2.69 | ALT |
| 2026-02-11T04:46:43Z | 4624 | ALT-WS-18 | a.zhuma | 10.40.2.69 | ALT |
| 2026-02-11T05:01:35Z | 5140 | ALT-SRV-FILE | d.abdrah | 10.40.2.47 | ALT |
| 2026-02-11T05:05:21Z | 4624 | ALT-WS-37 | m.nurpeis | 10.40.2.30 | ALT |
| 2026-02-11T05:06:24Z | 5140 | ALT-SRV-FILE | r.tleubaev | 10.40.2.36 | ALT |
| 2026-02-11T05:28:11Z | 5140 | ALT-SRV-FILE | r.tleubaev | 10.40.2.80 | ALT |
| 2026-02-11T05:51:27Z | 4624 | ALT-WS-29 | s.isaeva | 10.40.2.101 | ALT |
| 2026-02-11T05:56:25Z | 5140 | ALT-SRV-FILE | e.beketov | 10.40.2.54 | ALT |
| 2026-02-11T06:01:23Z | 4624 | ALT-WS-29 | t.kaliev | 10.40.2.31 | ALT |
| 2026-02-11T06:21:22Z | 4624 | ALT-WS-37 | m.nurpeis | 10.40.2.119 | ALT |
| 2026-02-11T06:27:23Z | 5140 | ALT-SRV-FILE | t.kaliev | 10.40.2.70 | ALT |
| 2026-02-11T06:47:54Z | 5140 | ALT-SRV-FILE | a.zhuma | 10.40.2.108 | ALT |
| 2026-02-11T06:51:48Z | 5140 | ALT-SRV-FILE | a.zhuma | 10.40.2.50 | ALT |
| 2026-02-11T06:54:07Z | 5140 | ALT-SRV-FILE | r.tleubaev | 10.40.2.101 | ALT |
| 2026-02-11T07:07:06Z | 5140 | ALT-SRV-FILE | d.abdrah | 10.40.2.81 | ALT |
| 2026-02-11T07:09:59Z | 5140 | ALT-SRV-FILE | a.zhuma | 10.40.2.89 | ALT |
| 2026-02-11T07:11:28Z | 4624 | ALT-WS-29 | s.isaeva | 10.40.2.108 | ALT |
| 2026-02-11T07:16:35Z | 4624 | ALT-WS-23 | r.tleubaev | 10.40.2.102 | ALT |
| 2026-02-11T07:18:08Z | 5140 | ALT-SRV-FILE | a.serik | 10.40.2.109 | ALT |
| 2026-02-11T07:23:51Z | 5140 | ALT-SRV-FILE | e.beketov | 10.40.2.93 | ALT |
| 2026-02-11T07:27:19Z | 4624 | ALT-WS-36 | e.beketov | 10.40.2.33 | ALT |
| 2026-02-11T07:29:27Z | 5140 | ALT-SRV-FILE | e.beketov | 10.40.2.50 | ALT |
| 2026-02-11T07:32:49Z | 5140 | ALT-SRV-FILE | s.isaeva | 10.40.2.75 | ALT |
| 2026-02-11T07:39:06Z | 4624 | ALT-WS-29 | s.isaeva | 10.40.2.116 | ALT |
| 2026-02-11T07:41:17Z | 5140 | ALT-SRV-FILE | s.isaeva | 10.40.2.39 | ALT |
| 2026-02-11T07:46:55Z | 4624 | ALT-WS-36 | d.abdrah | 10.40.2.114 | ALT |
| 2026-02-11T07:50:00Z | 5140 | ALT-SRV-FILE | s.isaeva | 10.40.2.100 | ALT |
| 2026-02-11T07:52:37Z | 4624 | ALT-WS-13 | a.serik | 10.40.2.38 | ALT |
| 2026-02-11T08:05:21Z | 4634 | ALT-WS-37 | m.nurpeis | — | ALT |
| 2026-02-11T08:07:24Z | 4634 | ALT-WS-23 | r.tleubaev | — | ALT |
| 2026-02-11T08:11:05Z | 5140 | ALT-SRV-FILE | e.beketov | 10.40.2.31 | ALT |
| 2026-02-11T08:15:23Z | 4625 | ALT-WS-36 | e.beketov | 10.40.2.112 | ALT |
| 2026-02-11T08:16:23Z | 4624 | ALT-WS-36 | e.beketov | 10.40.2.112 | ALT |
| 2026-02-11T08:17:38Z | 5140 | ALT-SRV-FILE | a.zhuma | 10.40.2.81 | ALT |
| 2026-02-11T08:24:39Z | 4624 | ALT-WS-13 | a.serik | 10.40.2.39 | ALT |
| 2026-02-11T08:28:53Z | 5140 | ALT-SRV-FILE | t.kaliev | 10.40.2.60 | ALT |
| 2026-02-11T08:43:19Z | 4624 | ALT-WS-23 | r.tleubaev | 10.40.2.101 | ALT |
| 2026-02-11T08:53:36Z | 4625 | ALT-WS-36 | e.beketov | 10.40.2.52 | ALT |
| 2026-02-11T08:55:36Z | 4624 | ALT-WS-36 | e.beketov | 10.40.2.52 | ALT |
| 2026-02-11T09:01:04Z | 5140 | ALT-SRV-FILE | s.isaeva | 10.40.2.34 | ALT |
| 2026-02-11T09:10:50Z | 5140 | ALT-SRV-FILE | a.serik | 10.40.2.62 | ALT |
| 2026-02-11T09:11:52Z | 5140 | ALT-SRV-FILE | a.zhuma | 10.40.2.99 | ALT |
| 2026-02-11T09:13:35Z | 4634 | ALT-WS-29 | s.isaeva | — | ALT |
| 2026-02-11T09:32:16Z | 4624 | ALT-WS-37 | m.nurpeis | 10.40.2.111 | ALT |
| 2026-02-11T09:36:21Z | 5140 | ALT-SRV-FILE | d.abdrah | 10.40.2.67 | ALT |
| 2026-02-11T09:45:38Z | 5140 | ALT-SRV-FILE | r.tleubaev | 10.40.2.59 | ALT |
| 2026-02-11T09:46:43Z | 4634 | ALT-WS-18 | a.zhuma | — | ALT |
| 2026-02-11T09:51:27Z | 4634 | ALT-WS-29 | s.isaeva | — | ALT |
Questions
0/7 · 0/100 points
Log in to save your progress and appear on the leaderboard.
Which account walked the folders?
Format: Account name · 15 points
Which address did it do this from?
Format: IPv4 address · 15 points
How many different network shares did it open?
Format: Whole number · 20 points
And how many accesses were there in total?
Format: Whole number · 15 points
When did it open the first folder? UTC.
Format: YYYY-MM-DD HH:MM:SS · 15 points
Which server holds those folders?
Format: Host name · 10 points
Which MITRE ATT&CK technique covers looking for reachable network shares?
Format: Identifier like T1234 · 10 points