Full Kill Chain: Correlate the Intrusion Across the Telemetry

The capstone. A host (web01) was compromised and you have four kinds of telemetry: SSH auth (/var/log/auth.log), web access (/var/log/nginx/access.log), outbound connections (/var/log/conn.log), and scheduled jobs (/etc/cron.d/). Each source has an innocent look-alike: one IP hammered SSH the hardest but never logged in, and another scanned the web app but never touched a shell. Volume and single-source rules will point you at the wrong host.

The real intruder is the one that ties the story together — it appears in MORE THAN ONE source: it brute-forced SSH AND then logged in AND then drove a webshell. That cross-source overlap is the whole lesson: a SOC analyst confirms an intrusion by CORRELATION, not by any single noisy signal.

Reconstruct the chain and record five things:

1. The attacker's source IP (/root/case/attacker_ip.txt) — the IP present in BOTH a successful SSH login AND webshell activity.

2. The webshell's request path (/root/case/webshell.txt).

3. The C2 destination IP (/root/case/c2_ip.txt) — the host the box beacons to and the malicious cron calls out to.

4. The persistence artifact's path (/root/case/persistence.txt) — the malicious /etc/cron.d/ file.

5. A correlation detector (/root/detect.sh) that prints the intruder's IP by intersecting successful-login sources with webshell sources — flagging the attacker and NOT the brute-force decoy or the scanner. Grading runs bash /root/detect.sh, and also re-runs it against a second, unseen incident as bash /root/detect.sh <logdir>, so read the logs from the directory given as the first argument, defaulting to /var/log (auth at ${1:-/var/log}/auth.log, web at ${1:-/var/log}/nginx/access.log). MITRE ATT&CK: T1110, T1505.003, T1071, T1053.