Hi, in the third question of the lab part of the assessment the question is: 3. To the attacker’s delight, they found that the credentials for the local cybrary user also worked on the domain! What time did they discover this? My answer was 21:25:57, as that is the first log indicating a lateral movement where they access the domain. But the answer is [redacted], and I don’t understand why that log is the right answer when I think they are the same and the other one is before. I will attach the log I saw, I just want to understand why am I wrong.
I am also battling with this for the whole week
It is the next lateral movement log, like ten minutes later, Joseph White, said the difference is they go from the account to the domain.