Threat HuntingMediumPro

Plant Folders

Company: Stepnoy Metall LLP

40 min7 questions100 pointsMITRE ATT&CK:T1135T1078

Briefing

Stepnoy Metall LLP is a metalworking plant. The file server STE-SRV-FILE has share access auditing enabled. Yesterday's log has accumulated, and something in it is off.

During the day the picture is ordinary: staff open their own department folders, one or two each. You are after the account that behaved differently — methodically, one folder at a time, outside the working day.

Share access is event 5140. The path is in file.share, the accessing address in source.ip. Timestamps are UTC.

This lab is part of the subscription

Get Pro to unlock every lab, the tracks and new material each month.

See pricing