Labs / Capstone investigations
RDP guess to a service that survives reboot
Follow one intruder across three Windows logs: failed RDP logons, a successful one, a hidden admin account, Defender turned off, and a service that looks like part of Defender.
Briefing
APP-14 had RDP exposed for a migration. At 03:20 an EDR heartbeat stopped. You have its Security, System, and Defender logs on a PowerShell prompt.
The Logon ID on a 4624 ties later events to that session. 4720 creates an account, 4732 adds it to a local group, 5001 means Defender real-time protection was turned off, and 7045 installs a service.
APP-14 · Capstone investigations
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.