Security Incident Cases

28 hands-on investigation cases with authentic log artifacts. Solve real alerts covering web attacks, credential stuffing, cloud breaches, and ransomware.

Getting Started very-easy

Hello World

Your first case. One question. One answer. Welcome to PracticeSIEM.

Getting Started very-easy

First Login

Seven people logged into the server today. Only one was first. The timestamp doesn't lie.

Getting Started very-easy

Count the Failures

Someone's hammering your SSH port right now. How many times did they fail before you noticed? (Spoiler: a lot)

Getting Started very-easy

The Odd One Out

Six logins. All green. Except one — from an IP that has no business being here. Spot the pattern break.

Getting Started very-easy

Root Access

Five team members used sudo today. Four of them did normal work. One did something sus. Find the odd one out.

Initial Access very-easy

The Locksmith

Someone is trying to break into your webserver. They're using a standard ssh brute-force tool, banging away at the login. Find the attacker's IP address and count how many failed attempts they made.

Network Forensics very-easy

Midnight Hammer

At 02:04 UTC the IDS fired on web-01. The on-call analyst took a quick look and went back to sleep — probably a script kiddie. You pulled the auth logs before rotation. Prove them wrong.

Active Directory very-easy

Ghost Account

HR flagged an unknown account in Active Directory this morning — svc_helpdesk_old. IT has no record of creating it. By the time anyone looked, it had already logged in. Windows Security Event Logs from the domain controller are attached.

Threat Hunting easy

Ghost User Login

Your web server logged legitimate users all day. But one user account shouldn't be logging in from anywhere, let alone from an external IP. Find the ghost.

Web Security easy

SQL Injection Hunt

Nginx logged something ugly this morning. Someone's running sqlmap against your API and they already got a 200 back with a payload that shouldn't work. Find what they extracted.

Threat Hunting easy

Midnight Logins

One user logged in from a different location starting at midnight. Normal office hours work doesn't happen in the middle of the night. Who broke pattern?

Network Forensics easy

Port Scan Sweep

Firewall lit up like a Christmas tree. One IP hit 20 different ports in 7 seconds. They weren't guessing — they were mapping. Two ports answered back.

Data Exfiltration easy

Data Exfil via FTP

The FTP backup service runs twice a day — 2am and 2pm. Both sessions grab small config files from the internal backup host. Last night there was a third session. From an IP that isn't in the building.

Threat Hunting easy

Permission Denied

Most of your team uses sudo for legitimate work. One user is systematically trying to steal every credential they can find. Who's hunting for secrets?

Persistence easy

Rogue SSH Key

Someone logged into the deploy account at 3:47am. Not with a password — with a key. Deploy never uses key-based auth. Someone planted a backdoor.

Incident Response easy

The Gardener

The dev team noticed a new file in the uploads directory on app-03. By the time they flagged it, the process tree looked wrong. You have auth logs and nginx access logs.

Network Forensics easy

Whispering Packets

A database server generated 1,200 DNS queries in under 10 minutes — all to subdomains of a domain registered 3 days ago. Figure out what left the building.

Threat Hunting medium

Password Spray

Twelve users. One password attempt each. Spread across 47 minutes from the same IP. Fail2ban never triggered. One account caved. This is what a spray looks like — and why it's so hard to catch.

Forensics medium

The Missing Hour

The auth log has a 47-minute hole in it. Logs don't develop holes on their own. Someone deleted the evidence — but they left fingerprints doing it.

Incident Response medium

Reverse Shell Caught

Someone uploaded a PHP file to the app server. Three minutes later they had a root shell. You have two log files. Reconstruct the attack from first upload to full compromise.

Threat Hunting medium

Follow the Pivot

One external IP logged into web-01. Seventeen minutes later, three servers were compromised and a database dump was on its way to Russia. Trace every hop.

Cloud Security medium

Golden Key

Your AWS CloudTrail lit up with API calls from an IP you've never seen before. Within 3 minutes they enumerated your entire infrastructure, created a new IAM user, and attached it to the Administrator policy. By the time the alert fired, they were already gone. Find out how they got in and what they accessed.

Threat Hunting medium

Sleeping Beauty

The IDS was offline for 6 hours. When it came back — nothing. Clean bill of health. But a junior analyst noticed the backup_svc account logged in twice at 3am. backup_svc doesn't run at 3am. Hunt season is open.

Active Directory hard

Golden Ticket

The domain controller flagged anomalous Kerberos ticket requests at 03:47. A service account that hasn't logged in for 8 months just authenticated to 14 different servers in 90 seconds. Windows Security Event Logs attached. Something golden this way comes.

Incident Response hard

Shadow in the Shadows

The SecOps team discovered that 47 servers across multiple departments had files encrypted overnight. But here's the twist: a manual administrator never touched a keyboard, and no external attacker was seen entering the network. The encryption started in your file server at 02:14 UTC.

Threat Hunting hard

Trojan Horse

A security researcher publicly disclosed that a popular npm package released 3 weeks ago contained a malicious payload. The code was dormant until an exact hostname matched — yours. Your prod environment just lit up with outbound connections to Telegram. Time to figure out what was downloaded and who is affected.

Advanced Threats hard

Living Off the Land

No malware dropped. No foreign binaries. Just curl, base64, wget, and bash — tools that ship with every Linux server. But in this sequence, they're a fully functional C2 implant. Find the campaign.

Cloud Security hard

Cloud Heist

A web app with a URL-fetching feature just became the attacker's proxy. They used it to hit the EC2 metadata service, grabbed IAM credentials, and used them from their own IP to download three S3 files before you noticed. Trace the full cloud attack chain.