Ransomware on the file server: hour zero

Logons, process creation, and file audit exports from an encrypted file server. Work back from the first renamed file to the recovery-killing commands and the RDP session behind them.

Terminal mission
Advanced
4 objectives
0 of 4 solved

Briefing

At 06:30 a finance user found every file on FS01 ending in .lockd. Backups are being checked; you have been asked when it started and how the attacker got in.

The SIEM exported three CSVs: logons (4624/4625), process creation (4688), and the file server audit log. Start from the impact and walk backwards.

analyst@ir-ws

ir-ws · Incident timelines

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@ir-ws:~$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.