Find the intrusion you staged a week ago

applied · 90 min · Objective 1.2

Task

Stage a multi-step intrusion across your lab using only built-in tools, wait long enough to forget the details, then investigate it from the telemetry alone. Objective 1.2 is analysing indicators, and this is all four families -- network, host, application, identity -- in one connected story.

Steps

  1. Stage it. In one sitting, perform a connected sequence: a failed login burst against several accounts, one success, a file fetched from the other VM over HTTP, a new local account created, a scheduled task added, and a series of outbound connections on a timer. Note the times in a sealed file on your host machine and do not open it.
  2. Wait. At least a day, ideally several. The delay matters: it forces you to work from evidence rather than memory, which is the actual skill.
  3. Investigate. Start from one artefact only -- the new account -- and pivot outward. Do not start from your notes.
  4. Build a timeline in UTC as you go, with a source and a confidence for every row.
  5. Answer, from evidence: when did it start, which account was first, what was accessed, what persists, and is it still running.
  6. Score yourself. Open the sealed file. Mark every staged action as found, missed, or misordered, and every timeline row as correct or wrong.

Verify

grep -E "useradd|new user" /var/log/auth.log | head -3
grep "Accepted" /var/log/auth.log | awk '{print $(NF-5), $(NF-3)}' | sort | uniq -c
awk '{print $1, $2, $3}' /var/log/collected/conn.log | head -1
awk '{print $1, $2, $3}' /var/log/collected/conn.log | tail -1

The first must show the account creation, which is your entry point. The second must show which accounts authenticated from where, which is how you bound the scope. The last two bound the window your timeline can cover -- a timeline claiming events outside that range is asserting something the evidence cannot support.

Notes

The score that matters is missed, not wrong. An action you never found is one your telemetry did not record or your pivots did not reach, and each one is a finding about the lab rather than about your analysis.

Keep the timeline. The Domain 3 labs reuse it as the incident you are responding to, and lesson 35's lab asks you to find its root causes.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.