Map the kill chain
Write up the intrusion in MITRE ATT&CK terms so the detection team can build coverage. Identify the techniques for the key behaviours and record your mapping.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
You recognise the behaviour and look up the ID; you don't memorise them.
Brute Force = T1110, Web Shell = T1505.003, PowerShell = T1059.001.
Solution explanation
You translated the raw findings into a MITRE ATT&CK map — brute force (T1110), valid accounts (T1078), discovery (T1046), web shell (T1505.003), PowerShell (T1059.001) and account creation (T1136). That mapping is what a detection team turns into coverage, and what lets another analyst instantly grasp the whole attack.
Show solution
cd /home/student
printf 'T1110 Brute Force (SSH)\nT1078 Valid Accounts (svc-backup)\nT1046 Network Service Discovery\nT1505.003 Web Shell (/uploads/avatar_8842.php)\nT1059.001 PowerShell (encoded)\nT1136 Create Account (support, UID 0)\n' > /home/student/attack-mapping.txt
cat /home/student/attack-mapping.txt