Correlating NAT, DHCP, VPN, and Web Logs After an Admin Login
On 18 September, a public-facing web server is suspected of compromise. The application logs use local time (UTC−5), the firewall and VPN concentrator use UTC, and the DHCP server retains 8-day leases. A suspicious admin login to /admin/export occurs at 14:32:07 in the application log. The firewall logs show an inbound HTTPS session from 203.0.113.88 at 19:32:11 UTC to the web server. The NAT device translates 203.0.113.88 to 10.20.4.15 at 19:31:58 UTC for a 600-second session. The DHCP scope for 10.20.4.0/24 shows a lease for 10.20.4.15 to workstation WS-114 from 12 September 08:00 to 20 September 08:00. WS-114’s user was on approved leave from 15 to 22 September, but the VPN log shows a login for her account from 198.51.100.42 at 19:28 UTC. The company uses split tunneling and a shared local admin password.
1. Correlate the application, firewall, NAT, DHCP, and VPN records to identify the most likely source of the admin login. Show the timeline and state your confidence.
Read the worked answer
The application login at 14:32:07 local is 19:32:07 UTC. The firewall records an inbound HTTPS session at 19:32:11 UTC, four seconds later, which is consistent with the same session. The NAT mapping translates 203.0.113.88 to 10.20.4.15 from 19:31:58 UTC for 600 seconds, so it covers 19:32:07. DHCP leases 10.20.4.15 to WS-114 for the relevant period. The VPN log shows the absent user’s account authenticating from 198.51.100.42 at 19:28 UTC, four minutes before the admin login.
The technical linkage is therefore strongest for WS-114 as the internal address at the time of the login, with a remote VPN session involving the same user account preceding it. Confidence in the IP-to-workstation linkage is moderate to high, subject to DHCP and NAT log integrity. Confidence that the absent employee personally performed the login is low: the account may have been shared, compromised, or used remotely, and split tunneling plus a shared local admin password weakens attribution. The report should separate machine-level correlation from person-level attribution.
2. What are the main attribution pitfalls, and what additional records would you request?
Read the worked answer
Pitfalls include NAT overload, where one public address represents many internal hosts; DHCP leases that may be stale, static, or mislogged; VPN credential sharing; split tunneling that lets a remote host reach internal resources while bypassing the VPN concentrator; and a shared local administrator password that removes individual accountability. Time synchronization errors, log rotation, and missing logs can also distort the sequence. The four-second difference between application and firewall timestamps should be explained rather than assumed.
Additional records should include VPN MFA and session details, WS-114 Security event logs for logons and process creation, EDR telemetry, proxy and NetFlow data, web-server authentication logs, DHCP server logs, NAT translation tables, and badge or physical-access records. The examiner should also request the workstation’s memory and disk image, email and chat records, and any help-desk tickets involving the account. Corroborating whether the VPN session mapped to WS-114 or only to the network is central.
3. How would you present this timeline in court without overstating the conclusion?
Read the worked answer
Present the timeline in a normalized UTC table with source, record type, original timestamp, converted timestamp, and a short interpretation. Distinguish three levels: the IP address was leased to WS-114; a session using that address reached the server; and a person using the absent employee’s account authenticated to VPN. Do not collapse those into “the employee logged in.”
Explain the confidence level and the alternative hypotheses: account compromise, credential sharing, an insider using the account, or a device behind the same NAT. Concede the limits of split tunneling and the shared admin password. If the examiner cannot show that the VPN session was bound to WS-114, say so. A careful, source-linked timeline is more persuasive than an overconfident attribution, and it gives the fact-finder the information needed to weigh the evidence.