Lab 1-6: Credential Harvester Detection

Users report getting locked out after entering their passwords. The SOC found suspicious activity from the web server's service account (www-data). Investigate this system for credential theft.