Wrong Parent
Company: Nur Integrator LLP
Briefing
Nur Integrator LLP is an IT services company. Process-start logs are collected from the workstations. A few hundred records accumulated over the day — a normal volume for an office.
Searching by process name is useless here: the name is chosen by whoever launches it, and they choose something that looks like a system process. You have to work with the pair — which process spawned which. That pair is determined by how the program got in, and is far harder to fake.
Fields: process.name for what started, process.parent.name for what started it, process.hash.sha256 for the hash. Timestamps are UTC.
Artifacts
The same data as files for real tools: open in Wireshark or Excel, or load into Elastic. The answers match — it is the same data.
| @timestamp | event.code | host.name | user.name | process.name | process.parent.name |
|---|---|---|---|---|---|
| 2026-03-05T04:02:06Z | 1 | NUR-WS-33 | t.kaliev | outlook.exe | explorer.exe |
| 2026-03-05T04:04:15Z | 1 | NUR-WS-47 | a.serik | winword.exe | explorer.exe |
| 2026-03-05T04:05:33Z | 1 | NUR-WS-13 | d.abdrah | svchost.exe | services.exe |
| 2026-03-05T04:15:11Z | 1 | NUR-WS-47 | a.serik | excel.exe | explorer.exe |
| 2026-03-05T04:17:07Z | 1 | NUR-WS-49 | s.isaeva | outlook.exe | explorer.exe |
| 2026-03-05T04:23:45Z | 1 | NUR-WS-57 | r.tleubaev | chrome.exe | explorer.exe |
| 2026-03-05T04:25:51Z | 1 | NUR-WS-49 | s.isaeva | excel.exe | explorer.exe |
| 2026-03-05T04:26:59Z | 1 | NUR-WS-46 | m.nurpeis | excel.exe | explorer.exe |
| 2026-03-05T04:27:44Z | 1 | NUR-WS-49 | s.isaeva | outlook.exe | explorer.exe |
| 2026-03-05T04:28:02Z | 1 | NUR-WS-47 | a.serik | winword.exe | explorer.exe |
| 2026-03-05T04:34:20Z | 1 | NUR-WS-51 | a.zhuma | chrome.exe | explorer.exe |
| 2026-03-05T04:35:25Z | 1 | NUR-WS-13 | d.abdrah | msedge.exe | explorer.exe |
| 2026-03-05T04:36:32Z | 1 | NUR-WS-33 | t.kaliev | outlook.exe | explorer.exe |
| 2026-03-05T04:42:43Z | 1 | NUR-WS-49 | s.isaeva | msedge.exe | explorer.exe |
| 2026-03-05T04:43:57Z | 1 | NUR-WS-46 | m.nurpeis | outlook.exe | explorer.exe |
| 2026-03-05T04:44:39Z | 1 | NUR-WS-13 | d.abdrah | teams.exe | explorer.exe |
| 2026-03-05T04:45:30Z | 1 | NUR-WS-35 | e.beketov | msedge.exe | explorer.exe |
| 2026-03-05T04:45:49Z | 1 | NUR-WS-35 | e.beketov | teams.exe | explorer.exe |
| 2026-03-05T04:49:49Z | 1 | NUR-WS-51 | a.zhuma | excel.exe | explorer.exe |
| 2026-03-05T04:51:09Z | 1 | NUR-WS-33 | t.kaliev | outlook.exe | explorer.exe |
| 2026-03-05T04:58:16Z | 1 | NUR-WS-46 | m.nurpeis | teams.exe | explorer.exe |
| 2026-03-05T05:00:55Z | 1 | NUR-WS-51 | a.zhuma | excel.exe | explorer.exe |
| 2026-03-05T05:01:02Z | 1 | NUR-WS-51 | a.zhuma | taskhostw.exe | svchost.exe |
| 2026-03-05T05:02:39Z | 1 | NUR-WS-51 | a.zhuma | svchost.exe | services.exe |
| 2026-03-05T05:04:00Z | 1 | NUR-WS-35 | e.beketov | svchost.exe | services.exe |
| 2026-03-05T05:05:52Z | 1 | NUR-WS-51 | a.zhuma | taskhostw.exe | svchost.exe |
| 2026-03-05T05:06:36Z | 1 | NUR-WS-49 | s.isaeva | teams.exe | explorer.exe |
| 2026-03-05T05:06:45Z | 1 | NUR-WS-49 | s.isaeva | winword.exe | explorer.exe |
| 2026-03-05T05:08:35Z | 1 | NUR-WS-46 | m.nurpeis | svchost.exe | services.exe |
| 2026-03-05T05:10:42Z | 1 | NUR-WS-33 | t.kaliev | teams.exe | explorer.exe |
| 2026-03-05T05:17:30Z | 1 | NUR-WS-13 | d.abdrah | chrome.exe | explorer.exe |
| 2026-03-05T05:22:11Z | 1 | NUR-WS-51 | a.zhuma | msedge.exe | explorer.exe |
| 2026-03-05T05:22:24Z | 1 | NUR-WS-35 | e.beketov | chrome.exe | explorer.exe |
| 2026-03-05T05:30:33Z | 1 | NUR-WS-33 | t.kaliev | teams.exe | explorer.exe |
| 2026-03-05T05:30:43Z | 1 | NUR-WS-33 | t.kaliev | taskhostw.exe | svchost.exe |
| 2026-03-05T05:32:54Z | 1 | NUR-WS-49 | s.isaeva | teams.exe | explorer.exe |
| 2026-03-05T05:37:27Z | 1 | NUR-WS-13 | d.abdrah | excel.exe | explorer.exe |
| 2026-03-05T05:42:23Z | 1 | NUR-WS-57 | r.tleubaev | svchost.exe | services.exe |
| 2026-03-05T05:43:55Z | 1 | NUR-WS-49 | s.isaeva | teams.exe | explorer.exe |
| 2026-03-05T05:54:53Z | 1 | NUR-WS-35 | e.beketov | msedge.exe | explorer.exe |
| 2026-03-05T05:55:01Z | 1 | NUR-WS-13 | d.abdrah | msedge.exe | explorer.exe |
| 2026-03-05T05:55:23Z | 1 | NUR-WS-13 | d.abdrah | taskhostw.exe | svchost.exe |
| 2026-03-05T05:55:50Z | 1 | NUR-WS-49 | s.isaeva | chrome.exe | explorer.exe |
| 2026-03-05T05:56:00Z | 1 | NUR-WS-33 | t.kaliev | chrome.exe | explorer.exe |
| 2026-03-05T05:58:56Z | 1 | NUR-WS-57 | r.tleubaev | taskhostw.exe | svchost.exe |
| 2026-03-05T06:01:18Z | 1 | NUR-WS-33 | t.kaliev | excel.exe | explorer.exe |
| 2026-03-05T06:01:37Z | 1 | NUR-WS-57 | r.tleubaev | msedge.exe | explorer.exe |
| 2026-03-05T06:02:25Z | 1 | NUR-WS-47 | a.serik | svchost.exe | services.exe |
| 2026-03-05T06:04:19Z | 1 | NUR-WS-57 | r.tleubaev | msedge.exe | explorer.exe |
| 2026-03-05T06:17:08Z | 1 | NUR-WS-13 | d.abdrah | winword.exe | explorer.exe |
| 2026-03-05T06:22:04Z | 1 | NUR-WS-47 | a.serik | svchost.exe | services.exe |
| 2026-03-05T06:24:21Z | 1 | NUR-WS-57 | r.tleubaev | chrome.exe | explorer.exe |
| 2026-03-05T06:26:54Z | 1 | NUR-WS-49 | s.isaeva | teams.exe | explorer.exe |
| 2026-03-05T06:35:13Z | 1 | NUR-WS-51 | a.zhuma | chrome.exe | explorer.exe |
| 2026-03-05T06:35:15Z | 1 | NUR-WS-13 | d.abdrah | excel.exe | explorer.exe |
| 2026-03-05T06:35:22Z | 1 | NUR-WS-35 | e.beketov | outlook.exe | explorer.exe |
| 2026-03-05T06:35:54Z | 1 | NUR-WS-51 | a.zhuma | teams.exe | explorer.exe |
| 2026-03-05T06:39:18Z | 1 | NUR-WS-49 | s.isaeva | svchost.exe | services.exe |
| 2026-03-05T06:40:00Z | 1 | NUR-WS-20 | d.abdrah | svchost.exe | winword.exe |
| 2026-03-05T06:41:36Z | 1 | NUR-WS-35 | e.beketov | msedge.exe | explorer.exe |
Questions
0/7 · 0/110 points
Log in to save your progress and appear on the leaderboard.
Which process starts with an unusual parent?
Format: Process name with extension · 15 points
Which process starts it?
Format: Process name with extension · 20 points
What is the hash of the started process?
Format: 64 hexadecimal characters · 20 points
On how many workstations did that pair appear?
Format: Whole number · 20 points
When did the pair first appear? UTC.
Format: YYYY-MM-DD HH:MM:SS · 15 points
Under which account did that first start happen?
Format: Account name · 10 points
Which MITRE ATT&CK technique covers masquerading under a system name?
Format: Identifier like T1234.005 · 10 points