Educational Lab Only
This lab teaches defensive log analysis. The simulated log files demonstrate what attacker activity looks like across auth, syslog, cron, and bash history. These skills are essential for incident response.
Briefing
An endpoint alert fired on the admin workstation at 02:15 UTC. The security team suspects the attacker modified shell configuration
and installed persistence during a maintenance window. Your job is to build the timeline from raw logs.
Cross-reference /var/log/auth.log, /var/log/syslog, /var/log/cron.log,
and /home/admin/.bash_history to reconstruct the full attack chain and confirm exfiltration activity.
MITRE ATT&CK
T1070.002 - Indicator Removal: Clear Linux or Mac System Logs
— The attacker left partial evidence. Also:
T1053.003 - Scheduled Task/Job: Cron
for the persistence mechanism.
Objectives
Check auth.log
Check syslog
Check bash_history
Isolate attack window
Find exfil evidence
Build full timeline
Evidence Flags
auth.log reviewed
syslog reviewed
bash_history reviewed
attack window isolated
exfil confirmed
attacker IP correlated