BlueTeamFiles Challenge • Pass‑the‑Hash → Lateral SMB/WinRM
All synthetic & inert • RFC 5737 IPs • .example domains • Per‑task submission & detailed summary
Score: 0 0%

Scenario

Company: Orion Finance Ltd (imaginary)

Alert: Unusual SMB and WinRM activity from a workstation to a finance file server. NTLM failures followed by success with a service account. Suspected Pass‑the‑Hash leading to lateral movement and data touch.

Goals: identify the vector, reconstruct the auth/process chain, confirm access & exfil attempt, map ATT&CK, propose detections & mitigations.

Environment (synthetic)

  • Workstation: wf‑41.corp.example (10.24.7.41)
  • File Server: fs‑fin.corp.example (10.24.12.20)
  • Domain Controller: dc‑01.corp.example (10.24.1.10)
  • Outbound proxy: 192.0.2.50
  • Exfil domain: finance-drop.nimbus.example → 203.0.113.90

Timer

Elapsed: 00:00

Evidence Tabs

2025-11-19T02:04:11Z EventID=4625 Logon Failure
  Workstation: wf-41.corp.example
  Target Server: fs-fin.corp.example
  LogonType=3 (Network)
  Account Used: CORP\svc-backup
  FailureReason: Unknown user name or bad password
  AuthPackage: NTLM

2025-11-19T02:04:17Z EventID=4648 A logon was attempted using explicit credentials
  CallerProcess: C:\Tools\psexec64.exe
  CallerProcessHash: SHA256: 9a...ff (synthetic)
  Target Server: fs-fin.corp.example
  Account: CORP\svc-backup
  Authentication Package: NTLM

2025-11-19T02:04:17Z EventID=4624 An account was successfully logged on
  SubjectLogonId: 0x5a2f13
  LogonType=3 (Network)
  User: CORP\svc-backup
  AuthPackage: NTLM
  Computer: wf-41.corp.example

Tasks

Task 1 — Identify the PtH vector

Select the correct abused account, auth package, and logon type.

Task 2 — Select all suspicious log lines (partial credit)

Choose every line that directly evidences PtH → lateral access → data touch → exfil attempt.

Task 3 — Map the MITRE ATT&CK techniques (select all that apply)