Digital Forensics & Incident Response

Investigate and respond to real Linux intrusions: triage a live incident, read logs, accounts, processes and disks for evidence, reverse-engineer inert malware samples, then contain, eradicate, and reconstruct a multi-host kill chain end to end. Defensive analysis, detection, and hardening only.