Log analysismedium200 pts0 solves
Brute-Force Timeline
The SOC received an alert for web01. The SSH log shows a lot of noise. Build the attack timeline: who attacked, who got in, and what did they do next?
Learning objectives
Read authentication logs, correlate failures with a success and follow post-compromise commands.
Instructions
Analyse auth.log (about 1,400 lines, synthetic). The flag appears in a command run with sudo after the intruder logged in.
Prerequisites: grep/awk or a log tool; basic SSH log knowledge.
Flag format:
cspk{...}Files: auth.log (112.6 KB) (download after registering)
Useful tools: Wazuh
References
Write-up
The full write-up and learning takeaways unlock after you solve this challenge — spoilers stay hidden until then.