Lesson 6.10: Capstone 1: a forensic timeline from first login to persistence
One incident, every technique of the first half of this course. Northwind's CI runner opened connections to an unknown address every thirty minutes. You establish the entry from the login records, read exactly what was run from the audit trail, find the changed files by change time, expose the timestomped persistence, collect and hash the evidence, and seal a report whose every line can be checked again.
24 min
You will learn to
- Establish initial access from login records
- Reconstruct commands from execve audit records
- Find changes in a time window by ctime
- Prove timestomping and persistence
- Collect, hash and report
Key terms
- Initial access
- How the attacker first got in; here a valid account with a leaked key.
- Privilege escalation
- Going from the account's rights to root; here through the docker group.
- Persistence
- What brings the attacker back: here a root cron job.
- Root cause
- The condition that made the incident possible and must change.
← Kernel modules and the taint flag · All lessons · Verifying container image signatures →