Lab Description:

A developer linux server has been compromised, and you have been assigned as the forensic investigator to determine exactly what happened. You have access to the both Linux machine developer & vpn linux servers that may reveal how the attacker accessed the environment. Your goal is to analyze the available evidence, reconstruct the attack timeline, identify the attacker’s actions after gaining access, and determine how they maintained control of the system. Throughout the investigation, correlate artifacts from the Linux system and VPN logs to uncover the complete attack chain.

Lab Objectives:

• Initial Access : Discover how the attacker initially compromised the server through misconfigurations.

• Persistence : Discover how the attacker maintained access to the compromised system.

• Privilege Escalation: Identify the techniques used by the attacker to escalate privileges on the Linux system.

• Discovery : Identify how the attacker gathered information about the system and environment.

• Lateral Movement : Investigate whether the attacker used remote access to move within the environment.

• Collection : Determine what information or files were collected by the attacker.

• Command and Control : Identify how the compromised system communicated with the attacker’s infrastructure.

• Exfiltration : Determine whether any data was transferred outside the environment.

• Malware Analysis: Examine how the malware was deployed by the attacker on the system.

• Log Analysis: Analyze system logs to trace the attacker’s actions and timeline.

• Remediation: Learn best practices to secure the system and prevent similar breaches in the future.

Tools and Techniques:

• Disk Forensic: FTK Imager, Sleuth Kit
• Log Analysis : Any Preferred Tool or SIEM
• Network Forensic: Zeek, Suricata, Wireshark, Network Miner
• Database Analysis: sqlitebrowser

Lab Evidence:

You will get access to all the evidence collected from the breached servers.

Password: threatbreach.io

Writeup

Writeup will be published soon, If you want to send your writeup to be evaluated share it on labs[@]threatbreach.io