Building the timeline

Order is everything

Once you know it is one actor, put the events in time order. The timestamps come from different clocks and formats, so you read them deliberately. The earliest attacker event here is the successful SSH login:

grep -F 'Accepted password' /srv/soc-data/linux/auth.log

In the terminal

student@vulntech:~$ grep -F 'Accepted password' /srv/soc-data/linux/auth.log
Mar 10 08:03:52 web01 sshd[9140]: Accepted password for svc-backup from 203.0.113.66 port 40511 ssh2

From there the web scan (08:10), the web-shell upload (08:12) and the Windows logon attack (08:20+) follow. A timeline like that is what turns raw logs into a narrative a manager or an incident report can use.