RDP intrusion on a file server: persistence, data out, a cleared log

01Session plan

Materials: the pack files on each trainee's machine, a printed worksheet from the pack page, and an examination log form. Pack page →

02Answer key

1. Q011 point

   On a copy of security-events.csv, compute the SHA-256 value, compare it with manifest.txt, and enter the first eight hex characters.

   Answer44cd2351

   The prefix matches the manifest line. A 350 KB CSV is exactly the kind of file that gets opened and saved by a spreadsheet; check the hash first, and again before you sign.

   Where

   manifest.txt, the security-events.csv line.

   Usual mistake

   Hashing the file after it has been opened and saved in a spreadsheet application.

   Hash calculatorF-04 Examination logSOP-02 Evidence intake and registration

2. Q022 points

   How many failed logons (event 4625) from 203.0.113.77 does security-events.csv hold?

   Answer1677

   Filter on EventId = 4625 and IpAddress = 203.0.113.77. The attempts run from 20:02:11 to 23:40:55 UTC, one every five to ten seconds. Two other addresses guess passwords across the whole window and must not be counted.

   Where

   security-events.csv, EventId and IpAddress columns.

   Usual mistake

   Counting every 4625 in the file, or every row from the address including the successful ones.

   Windows XML Event Log (EVTX)

3. Q032 points

   When did svc.backup open an interactive remote desktop session (4624, logon type 10) from 203.0.113.77? Give the time in UTC.

   Answer2026-05-08 23:41:09

   With Network Level Authentication the client authenticates first, which writes a 4624 of type 3 at 23:41:07, and the desktop session follows as type 10 two seconds later. The type 10 event is the one that marks the remote desktop session.

   Where

   security-events.csv, 4624 rows for svc.backup.

   Usual mistake

   Giving the type 3 logon at 23:41:07, or the 22:00:03 logon of the same account, which is the nightly backup.

   Windows XML Event Log (EVTX)

4. Q041 point

   Which logon ID (TargetLogonId) does that type 10 session have? Every later step in this pack is tied to it.

   Answer0x5a1f3c2

   0x5A1F3C2 is the session that runs from 23:41:09 to the logoff at 01:09:31. It appears as SubjectLogonId on the account creation, the group change, the task creation and the log clearing, and as LogonId on every Sysmon process of the intrusion.

   Where

   security-events.csv, the 4624 row at 23:41:09; then SubjectLogonId in later rows.

   Usual mistake

   Using the logon ID of the type 3 NLA logon (0x5A1F2E9), which ends after half a second.

   Windows XML Event Log (EVTX)

5. Q052 points

   Every failed attempt from 203.0.113.77 is logon type 3, although the attacker was trying remote desktop. Why?

   AnswerB — With Network Level Authentication credentials are checked before a desktop session exists, so failures are recorded as network logons; only a session that is built becomes type 10.

   Network Level Authentication moves the credential check in front of the session. The firewall rule for TCP 3389 and the type 10 session that follows the first success tie the attempts to remote desktop, not to file sharing.

   Where

   security-events.csv, 4625 rows from 203.0.113.77 and the two 4624 rows at 23:41:07 and 23:41:09.

   Usual mistake

   Reading logon type 3 as proof of SMB.

6. Q061 point

   Which account was created in session 0x5A1F3C2 and added to the local Administrators group?

   Answerdestek

   Event 4720 at 00:05:13 creates destek and 4732 at 00:05:41 adds it to Administrators, both with SubjectLogonId 0x5A1F3C2. Sysmon shows the two net.exe commands half a second earlier; the first one carries the new password in its command line, which is why command lines are handled as sensitive in a report.

   Where

   security-events.csv, 4720 and 4732; sysmon-events.csv, net.exe at 00:05:12 and 00:05:40.

   Usual mistake

   Answering svc.backup, the account that made the change.

   Windows XML Event Log (EVTX)

7. Q071 point

   Which program does the scheduled task WinSvcUpdate run? Give the full path.

   Answerc:\programdata\rc\svcupd.exe

   The Exec action runs C:\ProgramData\rc\svcupd.exe as S-1-5-18, the SYSTEM account. The task sits under \Microsoft\Windows\Maintenance, a folder chosen to look like a Windows task.

   Where

   WinSvcUpdate.xml, Actions/Exec/Command and Principal/UserId.

   Usual mistake

   Giving the task name or the URI instead of the command.

   Scheduled tasks

8. Q082 points

   The task file records its registration date. Convert it to UTC.

   Answer2026-05-09 00:09:03

   RegistrationInfo/Date reads 2026-05-09T03:09:03, local server time without an offset. Minus three hours gives 00:09:03 UTC, one second before event 4698 records the creation of the task. The two sources agree once both are in UTC.

   Where

   WinSvcUpdate.xml, RegistrationInfo/Date; security-events.csv, 4698; mft-excerpt.csv, the WinSvcUpdate record created in the same second.

   Usual mistake

   Copying 03:09:03 as UTC because the XML carries no offset.

   Scheduled tasksLocal time to UTC

9. Q092 points

   According to the $FILE_NAME attribute, when was C:\ProgramData\rc\rclone.exe created? UTC.

   Answer2026-05-08 23:56:40

   Created0x30 reads 2026-05-08 23:56:40, the second at which tar.exe extracted the archive (Sysmon 11 at 23:56:40.112). Created0x10 reads 2021-03-14 07:22:05; that value was written later, see the next question.

   Where

   mft-excerpt.csv, the rclone.exe row, Created0x30.

   Usual mistake

   Reading Created0x10, the time that most tools show as "created".

   $MFT (NTFS Master File Table)

10. Q102 points

    rclone.exe has a $STANDARD_INFORMATION creation time in 2021 and a $FILE_NAME creation time in May 2026. Which reading do the files support?

    AnswerC — The $STANDARD_INFORMATION time was set back on 8 May: Sysmon event 2 records the change at 23:58:03, the 0x10 record-change time is the same second, and the PowerShell command that set it is in the log.

    Three records agree: Sysmon 2 shows CreationUtcTime changed from 2026-05-08 23:56:40.112 to 2021-03-14 07:22:05; LastRecordChange0x10, which the usual time-setting calls do not write, reads 23:58:03; and the powershell.exe command line at 23:58:02 sets exactly those values in local time. The 2021 value is a claim written by the user.

    Where

    mft-excerpt.csv, rclone.exe; sysmon-events.csv, event 2 at 23:58:03 and powershell.exe at 23:58:02.

    Usual mistake

    Dating the arrival of a tool by the creation time shown in Explorer.

    $MFT (NTFS Master File Table)

11. Q112 points

    How many sessions to 198.51.100.200 does the firewall log record?

    Answer45

    45 sessions, all TCP 443 from 192.0.2.10. Sysmon event 3 shows the same address being reached by rclone.exe in session 0x5A1F3C2, and rclone.conf names it as the endpoint of the remote yedek. Converted to UTC the sessions start at 00:14:35 and the last one ends at 01:04:10.

    Where

    firewall-outbound.csv, dst_ip.

    Usual mistake

    Counting Sysmon event 3 rows instead, or including the sessions to 203.0.113.77.

12. Q122 points

    How much did the server send to 198.51.100.200, in whole megabytes (10^6 bytes, rounded down)?

    Answer4787

    The sum of bytes_sent over the 45 sessions is 4,787,772,858 bytes, about 4.8 GB. That is a volume measured at the firewall. It does not tell which files left or whether they arrived intact; rclone's command lines name the source folders D:\Paylasim\Projeler and D:\Paylasim\Muhasebe, and volume D: was not collected.

    Where

    firewall-outbound.csv, bytes_sent for dst_ip 198.51.100.200.

    Usual mistake

    Adding bytes_recv, or using 1,048,576 bytes per MB without saying so.

13. Q132 points

    When was the server's Security log cleared? UTC.

    Answer2026-05-09 01:07:44

    Event 1102 at 01:07:44, SubjectUserName svc.backup, SubjectLogonId 0x5A1F3C2; Sysmon records wevtutil.exe cl Security in the same second. The forwarded copy kept everything sent before the clearing, which is why the earlier questions can be answered at all.

    Where

    security-events.csv, 1102; sysmon-events.csv, wevtutil.exe.

    Usual mistake

    Taking the first event of the local log as the time of the attack.

    Windows XML Event Log (EVTX)

14. Q142 points

    When did the task first run svcupd.exe? UTC.

    Answer2026-05-09 03:00:00

    Sysmon event 1 at 03:00:00 UTC, user NT AUTHORITY\SYSTEM, parent svchost.exe; the trigger in the XML is 06:00 local time daily, the same moment. Two seconds later the process connects to 203.0.113.77:443, the address that guessed the password, and it does the same on 10 May. Something is still running.

    Where

    sysmon-events.csv, svcupd.exe rows; WinSvcUpdate.xml, StartBoundary; firewall-outbound.csv, sessions to 203.0.113.77.

    Usual mistake

    Giving 06:00, the trigger time, as UTC.

15. Q152 points

    svc.backup also logs on every night at 22:00. What separates those logons from the intrusion?

    AnswerC — The 22:00 logons are type 4 (batch) with no source address and run yedekci.exe to 192.0.2.40; the intrusion is type 10 from 203.0.113.77 with its own logon ID, and every act in it carries that ID.

    The logon type, the source address and above all the logon ID separate the two. Attributing by account alone would put the backup job inside the intrusion; attributing by logon ID keeps them apart.

    Where

    security-events.csv, 4624 rows for svc.backup; sysmon-events.csv, LogonId.

    Usual mistake

    Treating an account as one actor.

    SOP-08 Examination notes and working record

16. Q162 points

    Which sentence could the examiner sign from these files alone?

    AnswerC — After 1,677 failed attempts from 203.0.113.77, svc.backup opened a remote desktop session from that address at 23:41:09 UTC; in that session the account destek was created and made an administrator, a daily SYSTEM task was registered, about 4.8 GB was sent to 198.51.100.200 by rclone.exe, and the Security log was cleared at 01:07:44. The task ran on 9 and 10 May and connected to 203.0.113.77. Which files left, and who was at the keyboard, the files do not show.

    Sentence c ties each act to a record, gives counts and times in UTC, and states the two limits. Sentence a names content and an actor the files do not show and claims a completeness of deletion that the forwarded copy disproves. Sentence b ignores the forwarded copy and Sysmon. Sentence d contradicts the firewall log, which shows the backup traffic stays internal and the sessions to 198.51.100.200 fall on one night.

    Where

    All five data files; each fact in sentence c comes from one of them.

    Usual mistake

    Writing the story the case suggests instead of the one the records carry.

    F-04 Examination logSOP-09 Reporting and peer review

03Reconstructed timeline

The timeline as the correct answers build it. Local time is UTC+3.

04Scoring

Questions 1–11 carry one point each and question 12 carries three: 28 points in all. The finding paragraph is not scored by points; mark it against the four criteria below and discuss it in the debrief.

Finding paragraph: criteria

• Every time carries its basis, and the firewall times are converted from local session end to UTC.
• Acts are tied to a logon ID, not only to an account; the backup job is kept out of the intrusion.
• The backdated creation time is recognised and the arrival of the tools is dated from $FILE_NAME and Sysmon.
• The report gives the volume sent with its unit and source, and says that content and the person at the keyboard are not shown.
• The report states that the persistence is still active and names the task, the account and the address it contacts.

05Debrief

1. Volume hides signal. Filters and counts, written down with the filter, are what make a number in a report reproducible.
2. An account is not an actor. The logon ID is the thread that ties an act to one session.
3. Clearing a log removes the local copy only. Forwarded events, Sysmon and the file system keep their own records.
4. A creation time a user can set is a claim. $FILE_NAME, the record-change time and Sysmon event 2 are how you test it.

06Model finding

Between 20:02:11 and 23:40:55 UTC on 8 May 2026, 203.0.113.77 made 1,677 failed logon attempts on MRD-FS01 (security-events.csv, forwarded copy). At 23:41:09 UTC the account svc.backup opened a remote desktop session from that address (logon ID 0x5A1F3C2). In that session the local account destek was created and added to Administrators (00:05:13 and 00:05:41), the scheduled task \Microsoft\Windows\Maintenance\WinSvcUpdate was registered to run C:\ProgramData\rc\svcupd.exe daily as SYSTEM (00:09:03), and rclone.exe, whose creation time had been set back to 2021, sent 4,787 MB in 45 sessions to 198.51.100.200 between 00:14:35 and 01:04:10 UTC. The Security log on the server was cleared at 01:07:44 UTC in the same session. The task ran at 03:00 UTC on 9 and 10 May and connected to 203.0.113.77 each time; it was active at collection. The files do not show which files left the network or who used the account.

Report anatomy and confidence scale →