Incident Response
Difficulty: hard
Log Format: syslog
Shadow in the Shadows
The SecOps team discovered that 47 servers across multiple departments had files encrypted overnight. But here's the twist: a manual administrator never touched a keyboard, and no external attacker was seen entering the network. The encryption started in your file server at 02:14 UTC.
RansomwareLateral MovementFile Integrity
Investigation Scenario
The SecOps team discovered that 47 servers across multiple departments had files encrypted overnight. But here's the twist: a manual administrator never touched a keyboard, and no external attacker was seen entering the network. The encryption started in your file server at 02:14 UTC.