Elective: Multi-Stage Incident — Full Investigation Challenge

Prerequisites

• CIR-K003 through CIR-K007 (all C02 core cards)

Why This Lesson Matters

You have learned every individual skill in this course: evidence collection, live response, containment, persistence hunting, phishing investigation, C2 scoping. This card puts them all together into one multi-stage incident — the format of a real P1 call. There is no theory here. There is only evidence and your ability to read it.

1. Scenario Brief

Time: 03:12 UTC — your phone rings. SIEM alert: "Anomalous authentication + lateral movement detected."

Available artefacts: - auth.log from WS-042 (SSH events) - security.evtx from SRV-001 (Windows Security events) - sysmon.evtx from SRV-001 (Sysmon events 1, 3, 10, 11) - access.log from the internal web server on SRV-001

Your mission: Answer the following questions using only the provided artefacts.

2. Investigation Questions

Work through these in sequence. Each answer is evidence for the next question.

Q1.  What is the attacker's source IP?
     (auth.log: look for burst of "Failed password" → single "Accepted")

Q2.  Which account was compromised and at what time (UTC)?
     (auth.log: "Accepted password for <user>")

Q3.  What was the first command the attacker ran after login?
     (auth.log: sudo entry immediately after login)

Q4.  What technique did they use to move to SRV-001?
     (security.evtx: Event 4624 Type 3, LogonProcess field)

Q5.  What service did they install on SRV-001 for persistence?
     (security.evtx: Event 7045, ServiceName and ImagePath)

Q6.  Was a web shell deployed? What was its filename?
     (access.log: POST to upload endpoint → subsequent GET with cmd= parameter)

Q7.  What was the first OS command executed via the web shell?
     (access.log: GET /uploads/<shell>?cmd=<command>)

Q8.  Is there evidence of data exfiltration?
     (sysmon.evtx Event 3: large outbound from SRV-001 to external IP)

3. Deliverable: Incident Summary

After answering all eight questions, produce a one-page incident summary:

INCIDENT SUMMARY — CIR-K008-CHALLENGE

Severity:    [P1 / P2 / P3 — your classification with justification]
Timeline:    [UTC timestamps for each key event]
Scope:       [Confirmed compromised hosts and data at risk]

ATT&CK Map:
  [Event] → [Technique ID] — [Sub-technique]

Containment actions (what you would do right now):
  1.
  2.
  3.

Evidence gaps (what you still do not know):
  1.
  2.

4. Hints (expand only if stuck)

Hint 1: The brute-force has a very short window — filter auth.log for "Failed password" grouped by source IP and find the burst.

Hint 2: The lateral movement uses NTLM (NtLmSsp in the LogonProcess field of Event 4624) — this is Pass-the-Hash, not a normal credential login.

Hint 3: The web shell filename contains a digit. Check for POST requests to /upload and subsequent GETs to the same base path.

5. Lab

Assessment mode: ctf

challenge_spec_id: 207 — Brute → pivot

Submit: PREFIX{source_ip:compromised_account:service_name:webshell_filename}

All four values must be correct for the flag to validate.

6. Framework Alignment

7. Further Reading

• The DFIR Report — https://thedfirreport.com — Real incident write-ups in exactly this format
• SANS FOR508 Course — The industry standard IR and threat hunting certification

["Answer eight sequential investigation questions from a multi-source log set covering brute force, lateral movement, persistence, web shell deployment, and exfiltration", "Produce a complete incident summary including severity classification, UTC timeline, ATT&CK mapping, containment actions, and identified evidence gaps", "Submit a correctly formatted four-field CTF flag derived from correlated evidence across auth.log, EVTX, Sysmon, and web access logs"]

Prerequisites → Scenario brief → 8 investigation questions (sequential, each feeds the next) → Incident summary deliverable template → Hints → CTF lab (spec 207) → Framework alignment → Further reading