Open cardosec

Case B529D0 · Network · L4 Advanced

RDP Hops at 2am

Practise as: Incident drill · Interview

Live alertAt 02:14 svc-backup logs on via RDP (Event 4624, type 10) to WS-HR-07, then within 20 minutes to FS-01 and DC-02; the account normally only runs scheduled jobs.

Interview questionWalk me through your triage and containment.

  1. 01 What happened?
  2. 02 What is the impact?
  3. 03 What do you do?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Service account doing interactive RDP off-hours across tiers is a strong compromised-credential indicator
  2. Contain: disable and reset svc-backup, isolate hosts, block RDP east-west; reset krbtgt twice only if AD was compromised
  3. Build timeline from 4624/4625/4648, RDP logs (1149, 21/25), and EDR on each hop; find the initial host
  4. On DC-02 check for DCSync, NTDS.dit access, new admins (4728/4732), and GPO changes
  5. Scope: assume domain compromise if DC was interactive; plan credential rotation and possible krbtgt reset

If the interviewer pushes back

  • The backup system depends on svc-backup. How do you contain without destroying your recovery capability?

Go deeper

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.