RDP Brute Force: Internet-Facing Server Login
An internet-exposed Windows Server running RDP has been receiving a sustained brute-force campaign from an external address. After dozens of failed authentication events, one attempt succeeds and an interactive session is opened. Reconstruct the attack from the Windows Security event log, identify the source and target, and classify the technique.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Spot the anomaly in authentication logs
20The host VE-JUMP-01 is producing an unusual number of logon events. Before anything else, determine which external address is responsible for the authentication noise and what kind of logon it is attempting.
Identify the target account
15Every failed attempt in the burst names the same account. Determine which domain account was the target of the brute-force campaign.
Confirm the logon type
15Windows records why a logon succeeded or failed with a Logon Type code. Determine which Logon Type the attacker is using and what it means.
Find the moment of compromise
20After a long sequence of failures, one attempt finally succeeded. Pinpoint the timestamp of the first Event 4624 (successful logon) that arrived from the attacker's source IP.
Identify the missing control
15The attack succeeded because a standard defensive control was absent. Determine which specific Windows security setting, if configured, would have locked the account before the attacker found the correct password.
Map the technique
15Classify this attack pattern using the MITRE ATT&CK framework sub-technique that specifically describes guessing individual account passwords one by one until one works.
6 tasks · 100 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allAccount Takeover: Impossible-Travel Sign-In
A finance analyst's Microsoft Entra account is accessed without MFA from Moldova 18 minutes after their normal London sign-in. Impossible travel confirmed. The unauthorized session reads the inbox via Graph and adds an external recovery address. Work the Entra audit trail to identify the attacker IP, the compromised mailbox, and the persistence mechanism.
Open SMB Share: Unauthorized Data Access
A finance file share on an internal Windows server was misconfigured to allow all domain users read access. A workstation account with no finance role connected over SMB and bulk-read payroll records, M&A strategy documents, and board materials. Reconstruct the session from Windows Security audit events and internal firewall logs.
DNS Tunneling: Covert Exfiltration from One Host
A single workstation at Valkara Analytics has been leaking data all day through a DNS tunnel. Every query carries encoded payload chunks inside high-entropy subdomain labels to an attacker-controlled name server. Reconstruct the tunnel from resolver and firewall logs, identify the compromised host and the attacker's infrastructure, and map the technique to ATT&CK.