RDP intrusion on a file server: persistence, data out, a cleared log

01Brief

Meridyen Mimarlık Ltd. runs a Windows Server 2022 file server, MRD-FS01 (192.0.2.10), in the domain meridyen.example. A firewall rule added for a supplier in April left TCP 3389 on the server reachable from the internet. On Monday 11 May 2026 the IT administrator found an unknown local account, destek, in the server's Administrators group, and noticed that the server's own Security log began on Saturday with event 1102. An incident response examiner collected the files in this pack the same morning. The forwarded copy of the Security log on the event collector MRD-WEC01 was not affected by the clearing.

Internal audit asks:

1. Was the server entered, when, with which account and from which address?
2. What was left behind to keep access, and is it still running?
3. Was data sent out, how much and where to, and what does the cleared log change?

Answer from the files only. Name accounts, addresses, hosts and processes; do not name people. Say what was sent out in volume and destination, not what the files contained: volume D: was not collected.

02Evidence files

The hashes above are copied from manifest.txt. Recompute them yourself, for example with the hash tool or sha256sum.

You can also examine these files on the examination workbench: hashes, one UTC timeline, sessions and a findings draft in the browser.

03Before you start

• Verify every file against manifest.txt and write the result in your examination log before you read anything else.
• Write the time basis next to every time you copy out. The firewall log is local time and records the END of a session; the task file is local time without an offset.
• Count with a filter, not by eye. Write the filter you used next to every number.
• A timestamp a user can set is a claim. Compare it with one the user cannot set before you rely on it.

Keep your notes in F-02 Evidence intake form and F-04 Examination log.

04Questions

Answer from the files only. Each answer is checked in this browser; nothing is sent anywhere, and your answers are kept on this device until you clear them. 16 questions, 28 points.

1. Q011 pointsecurity-events.csvmanifest.txt

   On a copy of security-events.csv, compute the SHA-256 value, compare it with manifest.txt, and enter the first eight hex characters.8 hex characters
   Check

2. Q022 pointssecurity-events.csv

   How many failed logons (event 4625) from 203.0.113.77 does security-events.csv hold?A whole number
   Check

3. Q032 pointssecurity-events.csv

   When did svc.backup open an interactive remote desktop session (4624, logon type 10) from 203.0.113.77? Give the time in UTC.YYYY-MM-DD HH:MM:SS, UTC
   Check

4. Q041 pointsecurity-events.csv

   Which logon ID (TargetLogonId) does that type 10 session have? Every later step in this pack is tied to it.Hex value as written, e.g. 0x1A2B3C
   Check

5. Q052 pointssecurity-events.csv

   Every failed attempt from 203.0.113.77 is logon type 3, although the attacker was trying remote desktop. Why?

   AThe attacker was not using remote desktop at all but SMB, which the type 3 proves.BWith Network Level Authentication credentials are checked before a desktop session exists, so failures are recorded as network logons; only a session that is built becomes type 10.CThe forwarding to the collector rewrites logon types, so the original type cannot be known.DType 3 means the password was correct but the account was locked.
   Check

6. Q061 pointsecurity-events.csvsysmon-events.csv

   Which account was created in session 0x5A1F3C2 and added to the local Administrators group?Account name
   Check

7. Q071 pointWinSvcUpdate.xml

   Which program does the scheduled task WinSvcUpdate run? Give the full path.A full Windows path
   Check

8. Q082 pointsWinSvcUpdate.xmlsecurity-events.csvmft-excerpt.csv

   The task file records its registration date. Convert it to UTC.YYYY-MM-DD HH:MM:SS, UTC
   Check

9. Q092 pointsmft-excerpt.csv

   According to the $FILE_NAME attribute, when was C:\ProgramData\rc\rclone.exe created? UTC.YYYY-MM-DD HH:MM:SS, UTC
   Check

10. Q102 pointsmft-excerpt.csvsysmon-events.csv

    rclone.exe has a $STANDARD_INFORMATION creation time in 2021 and a $FILE_NAME creation time in May 2026. Which reading do the files support?

    AThe file has been on the server since 2021; the 2026 value is a later rename.BThe $FILE_NAME value is unreliable because Windows updates it on every access.CThe $STANDARD_INFORMATION time was set back on 8 May: Sysmon event 2 records the change at 23:58:03, the 0x10 record-change time is the same second, and the PowerShell command that set it is in the log.DNeither time can be used, so the creation of the file cannot be dated.
    Check

11. Q112 pointsfirewall-outbound.csv

    How many sessions to 198.51.100.200 does the firewall log record?A whole number
    Check

12. Q122 pointsfirewall-outbound.csv

    How much did the server send to 198.51.100.200, in whole megabytes (10^6 bytes, rounded down)?A whole number of MB
    Check

13. Q132 pointssecurity-events.csvsysmon-events.csv

    When was the server's Security log cleared? UTC.YYYY-MM-DD HH:MM:SS, UTC
    Check

14. Q142 pointssysmon-events.csvWinSvcUpdate.xmlfirewall-outbound.csv

    When did the task first run svcupd.exe? UTC.YYYY-MM-DD HH:MM:SS, UTC
    Check

15. Q152 pointssecurity-events.csvsysmon-events.csv

    svc.backup also logs on every night at 22:00. What separates those logons from the intrusion?

    ANothing; the same account was used, so all its activity that night must be treated as the attacker's.BThe time only: anything before midnight is the backup.CThe 22:00 logons are type 4 (batch) with no source address and run yedekci.exe to 192.0.2.40; the intrusion is type 10 from 203.0.113.77 with its own logon ID, and every act in it carries that ID.DThe backup uses a different password, which the event log records.
    Check

16. Q162 pointssecurity-events.csvsysmon-events.csvfirewall-outbound.csvmft-excerpt.csvWinSvcUpdate.xml

    Which sentence could the examiner sign from these files alone?

    AAn attacker from 203.0.113.77 stole 4.8 GB of project and accounting files and deleted all evidence of the intrusion.BBecause the Security log on the server was cleared, nothing about the night of 8 May can be established.CAfter 1,677 failed attempts from 203.0.113.77, svc.backup opened a remote desktop session from that address at 23:41:09 UTC; in that session the account destek was created and made an administrator, a daily SYSTEM task was registered, about 4.8 GB was sent to 198.51.100.200 by rclone.exe, and the Security log was cleared at 01:07:44. The task ran on 9 and 10 May and connected to 203.0.113.77. Which files left, and who was at the keyboard, the files do not show.DThe nightly backup job was compromised and has been sending data to 198.51.100.200 every night since April.
    Check

05Your finding

Last step: write one paragraph that answers the three audit questions as a finding. Your instructor marks it against four criteria:

• Every time carries its basis, and the firewall times are converted from local session end to UTC.
• Acts are tied to a logon ID, not only to an account; the backup job is kept out of the intrusion.
• The backdated creation time is recognised and the arrival of the tools is dated from $FILE_NAME and Sysmon.
• The report gives the volume sent with its unit and source, and says that content and the person at the keyboard are not shown.
• The report states that the persistence is still active and names the task, the account and the address it contacts.

How findings are phrased →