Investigating a suspected server compromise

A client asked me to assess whether its Windows server had been compromised. During the assessment, I identified malicious activity and then investigated the available logs to trace its source. The client’s identity and infrastructure details are withheld.

Tracing the activity

I reviewed the event logs to reconstruct the malicious login session. The records showed the account used, the source workstation recorded by the server, and the login and logout times. These details helped trace the activity back to its recorded source.

The review also identified repeated failed Windows and SQL Server login attempts from multiple external IP addresses. I documented these separately: failed attempts were evidence of attempted access, but did not establish that every source had gained access or belonged to the same attacker.

Moving remote access onto a private network

After the investigation, I secured access to the exposed services through a private VPN connection. I configured firewall restrictions to block direct public access to Remote Desktop and SQL Server while allowing the required connections through the private network.

Authorised administrators could continue using their usual remote desktop and database clients, connecting to the server’s private address after joining the VPN. The services remained available for legitimate work without leaving their login interfaces exposed to the public internet. Windows and database authentication still controlled access to the services.

How access changed

flowchart LR; A["Approved device"] --> B["Private VPN"]; B --> C["Firewall"]; C -->|Allowed| D["RDP / SQL login"]; E["Public internet"] -->|Blocked| C;

Result and scope

I delivered a written log-analysis report documenting the malicious session, its recorded source, related failed login activity, and access-control recommendations. The private-access setup reduced exposure to external scanning and password-guessing attempts while retaining remote administration.

The investigation traced technical source details available in the logs; those details alone did not establish the identity of the person responsible. Restricting network access addressed service exposure, rather than serving as proof that every possible effect of the compromise had been removed.

Recognition from a separate investigation

I also received a letter of appreciation from the Office of the Joint Commissioner of Police, Crime Branch, Ahmedabad City, recognising work by me and my team on a separate investigation. The copy below has been redacted for public display.