Threat HuntingMediumPro

Records Round

Company: Shipager Clinic

40 min7 questions100 pointsMITRE ATT&CK:T1135T1078

Briefing

Shipager Clinic is a private medical centre. The file server SHI-SRV-FILE has share access auditing enabled. Yesterday's log has accumulated, and something in it is off.

During the day the picture is ordinary: staff open their own department folders, one or two each. You are after the account that behaved differently — methodically, one folder at a time, outside the working day.

Share access is event 5140. The path is in file.share, the accessing address in source.ip. Timestamps are UTC.

This lab is part of the subscription

Get Pro to unlock every lab, the tracks and new material each month.

See pricing