Slow Burn

Challenge Question

You have a week of Windows security logs from a company network. There is no obvious brute-force spike, because a patient attacker spread their attempts thin across many sources so that no single one looked suspicious. Hunt through the events, look for the pattern hiding behind the noise, and find the one account that fell.