Final task: investigate an incident folder and find the suspicious IP
With the tools from the course you investigate, unguided, an incident folder collected from a server: from the authentication log the attacker’s address, the compromised account and the time of the first successful logon; from the user files the persistence methods; from the malicious script the command server and the script’s fingerprint; and you write it all into an incident report. The incident differs in every lab.
Level 101 · 60 min
Around 02:00 at night unusual traffic was seen on Northwind’s dispatch server. The incident response team collected the relevant files from the server and put them into the /srv/incident/IR-2026-031 folder: logs, files from a user’s home directory and scheduled tasks. Daniel: "Who got in, from where, when, and what did they leave behind? The report goes to management at 09:00."
This is a final task: apart from the first two steps I give no commands. You will use everything from the course: reading files, grep, cut, sort, uniq, redirection, sha256sum. If you get stuck, the hint reminds you of the method, and after two wrong tries the solution appears.
The first rule when working with evidence: don’t change the files you examine. Write your findings into your own ~/ir/ folder.
What you will do in this lesson
- Get to know the folder
- Who made the failed logons?
- The attacker and the account
- When?
- Persistence
- The command server
- The fingerprint
- The incident report
- Short quiz
Skills you will earn
- Pulling an incident out of an auth log
- Finding the top requesters in a log
- Finding persistence (.bashrc, cron)
- Verifying file integrity with digests (sha256sum -c)
- Writing an incident report
- Writing a short, precise finding
← Short task: build a daily summary with a one-liner · Linux fundamentals
Start for free