Educational Lab Only
This lab simulates a post-compromise forensic analysis of a poisoned shell configuration. You are in the role of a defender conducting incident response. Understanding attack patterns is essential for detection and remediation.
Briefing
A developer's workstation has been flagged by endpoint detection. Initial indicators suggest shell configuration tampering.
The attacker gained brief access and modified ~/.bashrc to establish persistence across reboots and harvest credentials.
The malicious additions are camouflaged among legitimate shell configuration.
Your mission: read the file, identify all four injected IOCs, and confirm your count.
MITRE ATT&CK
T1546.004 - Unix Shell Configuration Modification
— Adversaries may establish persistence through executing malicious commands triggered by shell configuration.
Also: T1547 - Boot/Logon Autostart Execution.
Objectives
Read .bashrc
Find alias backdoor
Decode reverse shell
Find PATH manipulation
Inspect attacker binaries
Count all IOCs
IOC Tracker
IOC-1: alias backdoor
IOC-2: reverse shell
IOC-3: PATH poison
IOC-4: cron dropper