back to labs
Auth Timeline: Find the Moment of Compromise
MediumDigital Forensics & Incident Response20-30 minThe brief
An alert flagged odd activity on this host overnight. The SSH authentication log in /var/log/auth.log holds the story: a wave of failed logins, then — somewhere in the noise — the attacker's first SUCCESS. Reconstruct the timeline: pin down the source doing the brute force, and identify which account they finally broke into. That 'first Accepted' line is the moment of compromise and the pivot point for the rest of your investigation.
Record your findings in two files under /root/case:
/root/case/attacker_ip.txt— just the attacker's IP address, one line./root/case/compromised_user.txt— just the compromised username, one line.
A copy of log lines or a list of every candidate is not an answer.
What you'll do
- Aggregate failed logins by source to find the brute-force IP
- Record the attacker's source IP to /root/case/attacker_ip.txt
- Find the first successful login from that IP and record the compromised username to /root/case/compromised_user.txt
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.