Advanced·500 points·2 solves
Enterprise Ransomware Investigation
Reconstruct a full intrusion backwards from its final act across five evidence sources, and learn the discipline that makes multi-source timeline work trustworthy: establish what time base each source is in before you merge any of them. You will also establish dwell time from first attacker action rather than from first alert, and read the ordering of backup destruction against encryption to judge intent.
Encryption is the last thing that happens. By the time a ransom note exists the intrusion is finished, and every question worth answering is in the past: how they got in, how long they were inside, what they touched first, and why the backups did not save anyone. Answering those means merging endpoint telemetry, Windows security events, file-server object access and a backup console into one ordered narrative. That merge is where this kind of investigation goes wrong, and it rarely announces itself. A timestamp with no trailing Z and no explicit offset is not UTC — it is UNKNOWN until you establish what wrote it and where that machine physically sits. Central collection pipelines normalise most sources and there is almost always an exception, usually an old one with a ticket open against it. If you sort a merged set without correcting for that, you do not get an error or a gap. You get an order that is internally consistent, entirely plausible, and wrong — and every downstream conclusion inherits it, including which machine the responders are sent to. The asset inventory in this collection records each site and its offset, and says which source the pipeline does not normalise. Read it early. The second thread is intent. Ransomware that merely encrypts is an outage; an operator who destroys the recovery points first has removed your alternative to paying, deliberately, and the ordering of those two events in the timeline is the evidence for saying so in a report. Evidence is in /var/log/soc — start with incident-brief.md, and read timeline-reference.md for the source formats.
Your tasks
1
Inventory your sources before reading any of them
There are five evidence files plus the ransom note. For each one, establish what its timestamps mean: does the string carry a trailing Z or an explicit offset, or is it bare? Then cross-reference asset-inventory.csv, which records the site and timezone of every host and contains an explicit note about the collection pipeline. Exactly one source is not normalised. Find out which, and by how many hours it is out — you are asked for that figure directly.
2
Start at the end and work backwards
Find the process that launched the encryption and record when it started. Then read encrypted-files-index.csv and total the affected files across every share — that number goes in the board report. Note that this index is written in UTC even though it comes from the same machine as the audit log that is not, which is exactly the sort of inconsistency real estates contain.
3
Establish what happened to the backups, and when
The backup console log is short and worth reading line by line. Identify when the recovery points were removed and which account did it, then compare that moment against the encryption start. The gap between them, and its direction, is what tells you whether the loss of backups was collateral damage or a prerequisite the operator arranged.
4
Find the true first attacker action
Now go to the beginning. Look for the earliest event that can be attributed to the intrusion rather than to ordinary work, across BOTH the endpoint telemetry and the file-server audit log — and apply the time correction you established in task one before you compare them. Record the host and the exact time in UTC. Then, separately, note which host you would have blamed had you merged the sources without correcting: one of the questions asks for that, because the previous responder's report says it and you need to be able to say specifically where it went wrong.
5
Fill in the middle: persistence and movement
Between entry and encryption, find what was created to survive a reboot — record its full name as it appears in the command line, not a description of it. Then identify the account used to reach other machines, and check asset-inventory.csv for what that account is supposed to be for and what standing privilege it holds. The reason it could delete backups is written there.
6
Compute dwell time and map the impact
Dwell time runs from the first attacker action to impact, in whole days — not from the first alert, and not from the ransom note. Getting the start wrong by a few hours changes a sentence; getting the wrong host changes where responders go. Finally map two separate techniques: the encryption itself, and the destruction of recovery points. They are distinct ATT&CK entries and a report that cites only the first understates what the operator did.
Answer the questions
Start the lab, investigate the evidence in the terminal, and answer the questions here.