Help Me, I Got Compromised
Five connected hosts. One breach. You are the incident responder. Follow the trail from the compromised gateway through log forensics, SOC triage, code review, and finally — defend a host that's actively under attack.
The Investigation
Five hosts. One breach. Follow the evidence.
The entry point. A compromised gateway with a webshell, a cron backdoor, and a SUID persistence binary. Document the artifacts and read the mission brief to find the rest of the network.
All logs from the breach are here. Parse auth.log, the Apache access log, and enriched SIEM events. Identify the attacker IP and reconstruct the full kill chain.
A queue of 15 alerts from the incident window. Triage true positives from false positives, then write a Python detection script that auto-classifies the queue.
The compromised developer's repository. Find the planted vulnerabilities using semgrep and manual review, then dig through git history for the credentials the attacker stole.
This host is under constant attack from 10.99.1.1. Configure fail2ban, enable ufw, block the attacker, and clean up the malware artifacts — in the right order. Resets every 30 minutes.
Ready to respond?
Start at the CIRT Gateway. The mission brief inside will guide you to the rest of the network.