ZEKASTRA case pack VP-05 - Remote desktop intrusion on a file server - SYNTHETIC TRAINING DATA
The organisation, people, hosts, accounts, keys and times are invented. Domains end in .example (RFC 2606) and every IP address is from a documentation range (RFC 5737).

Scenario (EN)
Meridyen Mimarlık Ltd. runs a Windows Server 2022 file server, MRD-FS01 (192.0.2.10), joined to the domain meridyen.example. A firewall rule added for a supplier in April left TCP 3389 on the server reachable from the internet. On Monday 11 May 2026 the IT administrator found an unknown local account, "destek", in the server's Administrators group, and the Security log on the server began on Saturday with event 1102. The company asked for an examination: was the server entered, how, from where, what was done, was data sent out, and what is still running.

Senaryo (TR)
Meridyen Mimarlık Ltd., meridyen.example etki alanına bağlı Windows Server 2022 dosya sunucusu MRD-FS01'i (192.0.2.10) işletir. Nisan ayında bir tedarikçi için eklenen bir güvenlik duvarı kuralı, sunucunun TCP 3389 kapısını internetten erişilebilir bıraktı. 11 Mayıs 2026 Pazartesi günü BT yöneticisi, sunucunun Administrators grubunda bilinmeyen bir yerel hesap ("destek") buldu; sunucudaki Security günlüğü Cumartesi günü 1102 olayıyla başlıyordu. Şirket bir inceleme istedi: sunucuya girildi mi, nasıl ve nereden, ne yapıldı, dışarıya veri gönderildi mi ve hâlâ çalışan bir şey var mı?

Files
security-events.csv     Security events forwarded to the collector MRD-WEC01, times UTC.
sysmon-events.csv       Sysmon events of MRD-FS01 (1, 2, 3, 11), times UTC.
firewall-outbound.csv   Edge firewall sessions to the internet, LOCAL time UTC+3, time = session end.
mft-excerpt.csv         $MFT of C:, excerpt, $STANDARD_INFORMATION (0x10) and $FILE_NAME (0x30) times, UTC.
WinSvcUpdate.xml        A scheduled task file from C:\Windows\System32\Tasks. Times inside are local server time (UTC+3), without an offset.
rclone.conf             A configuration file found in C:\ProgramData\rc. The keys are fake.
export-metadata.txt     Window, time basis and scope of every export. Read it first.
acquisition-log.txt     What was collected, when and how.
manifest.txt            SHA-256 of every file above.

Rules
1. Verify every file against manifest.txt before you read anything else.
2. Write the time basis next to every time you copy out. Convert to UTC before you compare two sources.
3. An account is not a person. A logon from an address shows the address that reached the server, not who sat at the keyboard.
4. A timestamp that a user can set is a claim, not a fact. Compare it with a timestamp the user cannot set.