Silent Service

Saryarka Telecom JSC is a regional telecom operator. While reviewing logs in the morning, two overnight entries turned up on the server SAR-SRV-BILL: a scheduled task was created and a service was installed.

On their own these are routine: administrators create tasks and install services constantly, and the day's log holds several. What needs review is not the fact but the circumstances: at what hour, under which account, and where the logon came from.

You have the security log for the day. Timestamps are UTC; the office runs on Astana time (UTC+5), so the working day is roughly 04:00–13:00 UTC.