RDP guesses, then a logon that worked

Use Get-WinEvent on an exported Security log to count failed RDP logons, find the source, and spot the account that finally got in with administrator-level privileges.

Terminal mission
Beginner
4 objectives
0 of 4 solved

Briefing

FS-01 is a file server with RDP open to the internet by mistake. You are on a PowerShell prompt with its Security log loaded.

Event 4625 is a failed logon and 4624 a successful one. Logon type 10 means Remote Desktop. 4672 right after a 4624 means the new session got special privileges. Get-WinEvent returns the newest events first.

PowerShell · FS-01

FS-01 · Windows event logs

Type help for the command list and objectives for your tasks. Everything runs in this browser.

PS /Users/analyst>

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.