Quiet Spray
Company: Zhetisu University
Briefing
Zhetisu University is a regional higher-education institution. Two alerts fired overnight: a run of failed logons on the file server ZHE-SRV-FILE and a large data transfer out from a workstation. The on-duty analyst is not sure they are connected.
You need to check whether it is one story. There are two sources: the Windows event log (the file server and the domain controller ZHE-DC-01) and a day of connection records. What ties them together is not a name or a time but the workstation's address.
The set contains harmless look-alikes. A service account with a stale password produces steady failed logons, the nightly backup walks the same folders, and a legitimate large upload leaves during the day. Tell them apart by the number of distinct accounts, by the source and by the account — not by the night-time hour.
Fields: event.code (4624 for a logon, 4625 for a failed logon, 4776 for validation on the domain controller, 5145 for access to an object on a network share), user.name, source.ip, file.share, winlog.logon.id. On the Network tab, bytes out and bytes in are shown separately. Timestamps are UTC (Astana is UTC+5).
Artifacts
The same data as files for real tools: open in Wireshark or Excel, or load into Elastic. The answers match — it is the same data.
Frames in the PCAP are truncated at capture to 96 bytes, as on a real perimeter: headers are enough for analysis and the on-wire length is genuine, so volumes in Statistics → Conversations match the table.
| @timestamp | event.code | host.name | user.name | source.ip | user.domain |
|---|---|---|---|---|---|
| 2026-10-06T00:25:48Z | 4624 | ZHE-DC-01 | ZHE-WS-19$ | 10.60.7.39 | ZHE |
| 2026-10-06T00:34:17Z | 4624 | ZHE-DC-01 | ZHE-WS-47$ | 10.60.7.36 | ZHE |
| 2026-10-06T01:03:54Z | 4624 | ZHE-DC-01 | ZHE-SRV-FILE$ | 10.60.7.39 | ZHE |
| 2026-10-06T01:09:51Z | 4624 | ZHE-DC-01 | ZHE-WS-58$ | 10.60.7.40 | ZHE |
| 2026-10-06T01:11:17Z | 4624 | ZHE-DC-01 | ZHE-WS-19$ | 10.60.7.103 | ZHE |
| 2026-10-06T01:12:15Z | 4624 | ZHE-DC-01 | ZHE-WS-47$ | 10.60.7.54 | ZHE |
| 2026-10-06T01:28:44Z | 4624 | ZHE-DC-01 | ZHE-WS-58$ | 10.60.7.79 | ZHE |
| 2026-10-06T01:45:13Z | 4624 | ZHE-DC-01 | ZHE-WS-47$ | 10.60.7.109 | ZHE |
| 2026-10-06T01:56:54Z | 4624 | ZHE-DC-01 | ZHE-WS-58$ | 10.60.7.77 | ZHE |
| 2026-10-06T02:07:29Z | 4624 | ZHE-DC-01 | ZHE-WS-14$ | 10.60.7.105 | ZHE |
| 2026-10-06T02:13:41Z | 4624 | ZHE-DC-01 | ZHE-WS-14$ | 10.60.7.107 | ZHE |
| 2026-10-06T02:14:34Z | 4624 | ZHE-DC-01 | ZHE-WS-58$ | 10.60.7.97 | ZHE |
| 2026-10-06T02:31:52Z | 4624 | ZHE-DC-01 | ZHE-SRV-APP$ | 10.60.7.113 | ZHE |
| 2026-10-06T02:32:32Z | 4624 | ZHE-DC-01 | ZHE-WS-47$ | 10.60.7.92 | ZHE |
| 2026-10-06T03:13:01Z | 4624 | ZHE-DC-01 | ZHE-WS-14$ | 10.60.7.96 | ZHE |
| 2026-10-06T03:28:57Z | 4624 | ZHE-DC-01 | ZHE-WS-52$ | 10.60.7.113 | ZHE |
| 2026-10-06T03:39:58Z | 4624 | ZHE-DC-01 | ZHE-WS-14$ | 10.60.7.69 | ZHE |
| 2026-10-06T04:02:06Z | 4624 | ZHE-DC-01 | ZHE-WS-47$ | 10.60.7.58 | ZHE |
| 2026-10-06T04:18:22Z | 4624 | ZHE-DC-01 | ZHE-WS-14$ | 10.60.7.97 | ZHE |
| 2026-10-06T04:26:59Z | 4624 | ZHE-DC-01 | ZHE-WS-19$ | 10.60.7.40 | ZHE |
| 2026-10-06T04:36:07Z | 4624 | ZHE-WS-58 | s.isaeva | 10.60.7.50 | ZHE |
| 2026-10-06T04:42:25Z | 4624 | ZHE-DC-01 | ZHE-WS-14$ | 10.60.7.46 | ZHE |
| 2026-10-06T04:47:19Z | 4624 | ZHE-WS-52 | a.serik | 10.60.7.119 | ZHE |
| 2026-10-06T04:50:27Z | 4624 | ZHE-DC-01 | ZHE-SRV-FILE$ | 10.60.7.46 | ZHE |
| 2026-10-06T04:50:41Z | 4624 | ZHE-WS-14 | e.beketov | 10.60.7.66 | ZHE |
| 2026-10-06T05:23:16Z | 4624 | ZHE-WS-58 | t.kaliev | 10.60.7.88 | ZHE |
| 2026-10-06T05:37:56Z | 4624 | ZHE-DC-01 | ZHE-WS-14$ | 10.60.7.89 | ZHE |
| 2026-10-06T05:40:16Z | 4624 | ZHE-DC-01 | ZHE-WS-58$ | 10.60.7.54 | ZHE |
| 2026-10-06T05:49:33Z | 4624 | ZHE-DC-01 | ZHE-SRV-APP$ | 10.60.7.93 | ZHE |
| 2026-10-06T05:54:58Z | 4624 | ZHE-DC-01 | ZHE-WS-52$ | 10.60.7.85 | ZHE |
| 2026-10-06T06:07:28Z | 4624 | ZHE-WS-58 | s.isaeva | 10.60.7.47 | ZHE |
| 2026-10-06T06:14:02Z | 4624 | ZHE-WS-19 | r.tleubaev | 10.60.7.100 | ZHE |
| 2026-10-06T06:16:22Z | 4624 | ZHE-DC-01 | ZHE-WS-52$ | 10.60.7.36 | ZHE |
| 2026-10-06T06:16:45Z | 4625 | ZHE-WS-19 | r.tleubaev | 10.60.7.90 | ZHE |
| 2026-10-06T06:18:45Z | 4624 | ZHE-WS-19 | r.tleubaev | 10.60.7.90 | ZHE |
| 2026-10-06T06:35:48Z | 4625 | ZHE-WS-14 | e.beketov | 10.60.7.103 | ZHE |
| 2026-10-06T06:36:48Z | 4624 | ZHE-WS-14 | e.beketov | 10.60.7.103 | ZHE |
| 2026-10-06T06:58:09Z | 4624 | ZHE-DC-01 | ZHE-SRV-APP$ | 10.60.7.82 | ZHE |
| 2026-10-06T06:58:36Z | 4624 | ZHE-WS-52 | a.serik | 10.60.7.101 | ZHE |
| 2026-10-06T07:01:30Z | 4624 | ZHE-DC-01 | ZHE-WS-38$ | 10.60.7.98 | ZHE |
| 2026-10-06T07:03:35Z | 4624 | ZHE-WS-19 | r.tleubaev | 10.60.7.53 | ZHE |
| 2026-10-06T07:14:55Z | 4624 | ZHE-WS-14 | e.beketov | 10.60.7.55 | ZHE |
| 2026-10-06T07:23:41Z | 4624 | ZHE-WS-14 | d.abdrah | 10.60.7.99 | ZHE |
| 2026-10-06T07:27:05Z | 4624 | ZHE-DC-01 | ZHE-SRV-FILE$ | 10.60.7.36 | ZHE |
| 2026-10-06T07:28:28Z | 4624 | ZHE-WS-58 | t.kaliev | 10.60.7.30 | ZHE |
| 2026-10-06T07:30:12Z | 4624 | ZHE-DC-01 | ZHE-WS-14$ | 10.60.7.95 | ZHE |
| 2026-10-06T07:30:37Z | 4624 | ZHE-DC-01 | ZHE-WS-38$ | 10.60.7.114 | ZHE |
| 2026-10-06T07:36:17Z | 4624 | ZHE-DC-01 | ZHE-WS-47$ | 10.60.7.114 | ZHE |
| 2026-10-06T07:47:09Z | 4624 | ZHE-SRV-FILE | a.zhuma | 10.60.7.33 | ZHE |
| 2026-10-06T07:51:30Z | 4624 | ZHE-WS-14 | d.abdrah | 10.60.7.42 | ZHE |
| 2026-10-06T08:08:50Z | 4624 | ZHE-WS-38 | m.nurpeis | 10.60.7.115 | ZHE |
| 2026-10-06T08:14:07Z | 4624 | ZHE-WS-14 | e.beketov | 10.60.7.96 | ZHE |
| 2026-10-06T08:25:29Z | 4624 | ZHE-DC-01 | ZHE-WS-38$ | 10.60.7.95 | ZHE |
| 2026-10-06T08:27:02Z | 4624 | ZHE-DC-01 | ZHE-WS-47$ | 10.60.7.58 | ZHE |
| 2026-10-06T08:42:28Z | 4624 | ZHE-WS-19 | r.tleubaev | 10.60.7.63 | ZHE |
| 2026-10-06T09:00:33Z | 4624 | ZHE-SRV-FILE | a.zhuma | 10.60.7.33 | ZHE |
| 2026-10-06T09:06:08Z | 4624 | ZHE-WS-58 | s.isaeva | 10.60.7.97 | ZHE |
| 2026-10-06T09:13:00Z | 4624 | ZHE-DC-01 | ZHE-WS-14$ | 10.60.7.71 | ZHE |
| 2026-10-06T09:28:59Z | 4624 | ZHE-DC-01 | ZHE-WS-52$ | 10.60.7.108 | ZHE |
| 2026-10-06T09:39:10Z | 4625 | ZHE-WS-52 | a.serik | 10.60.7.70 | ZHE |
Questions
0/8 · 0/110 points
Log in to save your progress and appear on the leaderboard.
Which internal address tried to log on under dozens of different accounts?
Format: IPv4 address · 10 points
How many different accounts were tried from that address?
Format: Whole number · 15 points
Under which account did the logon succeed?
Format: Account name · 15 points
When did the logon succeed? UTC.
Format: YYYY-MM-DD HH:MM:SS · 15 points
How many different network shares did that account access after the logon?
Format: Whole number · 15 points
How many bytes did the largest session from that same address send out?
Format: Whole number of bytes · 20 points
Which external address did the data go to?
Format: IPv4 address · 10 points
Which MITRE ATT&CK technique covers trying one password across many accounts?
Format: Identifier like T1234.005 · 10 points