SIEM Visualization Example 4: Users Added Or Removed From A Local Group (Within A Specific Timeframe)

HTB Content Academy
, ,
1

I am trying to do the question for: SIEM Visualization Example 4: Users Added Or Removed From A Local Group (Within A Specific Timeframe) and I am running into issues.

Navigate to http://[Target IP]:5601, click on the side navigation toggle, and click on "Dashboard". Extend the visualization we created or the "User added or removed from a local group" visualization, if it is available, and enter the common date on which all returned events took place as your answer. Answer format: 20XX-0X-0X

It had me set a custom date range: As discussed, we want to monitor user additions or removals from the local “Administrators” group within a specific timeframe (March 5th 2023 to date).

But when I do this it returns three (3) values all occurring on 2023-02-27. When I remove the custom date filter it does not return any value taking place after 2023-03-05 so I am not able to successfully answer the question.

Filters:

  • event.code is one of 4732, 4733
  • group.name: administrators

Is this an academy issue or am I doing something wrong. Any insight is appreciated

Screenshot 2024-11-27 at 12.51.45 PM
Screenshot 2024-11-27 at 12.51.45 PM1711Ă—194 71.5 KB

2

So I just did a brute force and the answer does not match any of the values provided in @timestamp, event.created, or event.ingested. The answer is the filter date (2023-05-03) for anyone that comes across this and is stuck.

Let’s all hope this is not a consistent issue across the board

1 Like
3

This answer doesnt work either I get incorrect answer for everything

4

The date is (2023-03-05) for March 5th 2023. It’s an incorrectly worded question, or has the incorrect answer.

5

I tried that and it says the date is incorrect

6

the date is not equal to any values provided in @timestamp, event.created, or event.ingested.
but try 2023-03-05 it is the solution

1 Like