Threat Hunting
Difficulty: easy
Log Format: syslog
Permission Denied
Most of your team uses sudo for legitimate work. One user is systematically trying to steal every credential they can find. Who's hunting for secrets?
Privilege EscalationCredential HarvestingReconnaissance
Investigation Scenario
Most of your team uses sudo for legitimate work. One user is systematically trying to steal every credential they can find. Who's hunting for secrets?