Lab 1-3: Hidden Files & Ghost Artifacts

Mission Briefing

You have been given access to a server suspected of data exfiltration. Initial scans by the security team found nothing unusual -- the directory appears to contain only routine quarterly reports. Your mission: dig deeper. Attackers routinely hide evidence in dot-files and nested hidden directories that standard listing commands will not reveal. Find every artifact the attacker left behind.

MITRE ATT&CK Mapping

T1564 -- Hide Artifacts T1036 -- Masquerading

Forensic Tip

By default, ls does not show files or directories that begin with a dot (.). Attackers exploit this behavior to hide malicious tools, exfiltration logs, and C2 beacons in plain sight. Always use ls -a or find during an investigation to ensure nothing is missed.

Objectives

1
Run ls in ghost_lab -- what do you see?
2
Run ls -a to reveal hidden files
3
Read the .ghost_data file
4
Use find to locate ALL files recursively
5
Read the C2 config file config.dat
6
Analyze the beacon script c2_beacon.sh

0 / 6

Navigate to ghost_lab and run ls -- what do you see?

Navigate to ~/ghost_lab and start investigating...

Evidence Recovered

Objectives

Investigation Complete