First triage
You have just sat down at the desk with five evidence sources and no briefing. Get your bearings: confirm what evidence you have, then pull the one fact that every other source will revolve around — the attacker's IP address.
The Linux auth.log records a single successful SSH login from an external address after a storm of failures. That address is your attacker.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Everything lives under /srv/soc-data/. Start with `ls -R`.
`grep 'Accepted password' /srv/soc-data/linux/auth.log` prints the one successful login.
Solution explanation
Triage is this calm: inventory the evidence, then find the first hard fact and write it down. One grep for Accepted password gave you the attacker's IP, 203.0.113.66 — the thread you will now pull through the web, Windows, packet and IDS evidence in the modules that follow.
Show solution
cd /home/student
ls -R /srv/soc-data
grep -F 'Accepted password' /srv/soc-data/linux/auth.log
echo 203.0.113.66 > /home/student/findings.txt