Threat Hunting
Difficulty: medium
Log Format: syslog
Follow the Pivot
One external IP logged into web-01. Seventeen minutes later, three servers were compromised and a database dump was on its way to Russia. Trace every hop.
Lateral MovementSSHCredential Harvesting
Investigation Scenario
One external IP logged into web-01. Seventeen minutes later, three servers were compromised and a database dump was on its way to Russia. Trace every hop.