A new administrator and a cleared Security log on NW-DC01 Start this lab

Why this matters

A cleared Security log is not a dead end — it is itself an event, with a time and an account attached. This case teaches how to work a domain controller after the adversary tried to erase the record, and why the clearing is often the most useful finding in the report.

Concepts

Objectives graded

• Work a Windows domain controller with cmd.exe and Event Viewer under anti-forensics conditions
• Prove account creation, promotion, service persistence and the log clearing that hid them
• Contain the controller and the rogue account under approval, then record the full timeline

MITRE ATT&CK coverage

A stolen admin session on the domain controller creates an account, promotes it to Administrators, installs a service that beacons out, and clears the Security log to hide the sequence.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20 · T1136.001 Create Account: Local Account (Persistence)

• A consequential action passed through a human approval gate.

  safety · weight 15 · T1136.001 Create Account: Local Account (Persistence)

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10 · T1070.001 Indicator Removal: Clear Windows Event Logs (Defense Evasion)

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10 · T1098 Account Manipulation (Persistence)

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10 · T1136.001 Create Account: Local Account (Persistence)

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15 · T1070.001 Indicator Removal: Clear Windows Event Logs (Defense Evasion)

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10 · T1098 Account Manipulation (Persistence)

• The analyst worked the domain controller directly instead of grading the alert text.

  investigation · weight 10 · T1136.001 Create Account: Local Account (Persistence)

• The analyst can name the event that proves the audit log was cleared.

  investigation · weight 10 · T1070.001 Indicator Removal: Clear Windows Event Logs (Defense Evasion)

• The rogue administrator account was identified from creation and group-add events.

  investigation · weight 10 · T1136.001 Create Account: Local Account (Persistence)

• The external peer was proven from the controller's own socket table.

  investigation · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The live beacon was identified by PID before anything was contained.

  behavior · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The scheduled task that re-arms the implant was found despite its plausible name.

  behavior · weight 10 · T1053.005 Scheduled Task/Job: Scheduled Task (Persistence)

• The compromised domain controller is isolated at end state.

  behavior · weight 15 · T1543.003 Create or Modify System Process: Windows Service (Persistence)

• The rogue administrator account is disabled at end state.

  behavior · weight 10 · T1098 Account Manipulation (Persistence)

• The machine-wide Run key persistence was recorded, so eradication is complete.

  explanation · weight 10 · T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (Persistence)

• A post-incident timeline was filed: stolen session, account creation, promotion, service install, log clear, containment.

  explanation · weight 15 · T1070.001 Indicator Removal: Clear Windows Event Logs (Defense Evasion)

• The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.

  investigation · weight 5

• The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.

  investigation · weight 3

• Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.

  investigation · weight 3

Common mistakes

• Treating the cleared log as a reason to stop rather than as a dated finding.
• Missing the machine-wide Run key because the scheduled task was found first.
• Judging MicrosoftEdgeUpdateTaskCore by name instead of by the C:\Windows\Temp action.
• Isolating NW-ADM05 before the stolen session is reviewed, taking admin access offline with it.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.