BTLO – Investigation: Backstage

Link: https://blueteamlabs.online/home/investigation/98

We were notified of some unusual activity in our network from one of our newly set up servers. Not taking any chances, we immediately took the system down and decided to investigate. You are provided with access to the system and the network packet capture file. Find out what is going on!

Scenario

Conclusion

This challenge definitely took a little bit. I was able to get most of the questions besides 2/3, I was overlooking the simple answers and looking too deep into it. I still found it a lot of fun to gather all the information and generate a timeline of the attack.