Challenge: Intrusion Detective

You're the on-call analyst. An alert fired overnight. You have three logs from the affected server. Your job: figure out what happened, which accounts/systems are affected, and write it up so the team can respond.

• 🥉 Bronze — identify the attacker IP and the attack type.
• 🥈 Silver — reconstruct the timeline and name every compromised account.
• 🥇 Gold — produce a complete incident report with scope, impact, and recommended actions, all in clean code.

Run this once to create the three log files for the case (auth, web, and a file-integrity report). It embeds a realistic attack amid normal noise.

import random
from datetime import datetime, timedelta
from pathlib import Path

base = datetime(2026, 5, 28, 2, 0, 0)
NORMAL_IPS = ["10.0.0.5", "10.0.0.8", "10.0.0.12"]
ATTACKER = "203.0.113.66"

auth, web = [], []

# normal background traffic
for i in range(200):
    t = base + timedelta(minutes=random.randint(0, 600))
    ip = random.choice(NORMAL_IPS); user = random.choice(["aisha", "ben", "lee"])
    auth.append(f"{t:%Y-%m-%d %H:%M:%S} sshd: Accepted password for {user} from {ip}")

# THE ATTACK — brute force then success then web activity
attack_start = base + timedelta(minutes=74)        # 03:14
for i in range(300):                                # brute force burst
    t = attack_start + timedelta(seconds=i * 0.2)
    auth.append(f"{t:%Y-%m-%d %H:%M:%S} sshd: Failed password for admin from {ATTACKER}")
crack = attack_start + timedelta(seconds=61)
auth.append(f"{crack:%Y-%m-%d %H:%M:%S} sshd: Accepted password for admin from {ATTACKER}")
for path, code in [("/admin", 200), ("/admin/users", 200),
                   ("/uploads/shell.php", 200), ("/etc/passwd", 403)]:
    t = crack + timedelta(seconds=random.randint(30, 300))
    web.append(f"{t:%Y-%m-%d %H:%M:%S} {ATTACKER} GET {path} {code}")

random.shuffle(auth)            # logs aren't sorted in real life
Path("auth.log").write_text("\n".join(auth))
Path("access.log").write_text("\n".join(web))
Path("fim_report.txt").write_text(
    "MODIFIED  /var/www/index.php\nADDED     /var/www/uploads/shell.php\n")
print("evidence written: auth.log, access.log, fim_report.txt")

Parse auth.log and identify the source IP responsible for an abnormal number of failed logins, and the attack type. (Lesson 25's brute-force detector.)

import re
from collections import Counter
from datetime import datetime

LINE = re.compile(r"(?P<ts>\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}) sshd: "
                  r"(?P<result>Failed|Accepted) password for (?P<user>\S+) "
                  r"from (?P<ip>\d+\.\d+\.\d+\.\d+)")

records = []
for line in open("auth.log"):
    m = LINE.search(line)
    if m:
        records.append({"ts": datetime.strptime(m["ts"], "%Y-%m-%d %H:%M:%S"),
                        "result": m["result"], "user": m["user"], "ip": m["ip"]})

fails = Counter(r["ip"] for r in records if r["result"] == "Failed")
attacker, count = fails.most_common(1)[0]
print(f"🥉 Attacker IP: {attacker} ({count} failed logins) → BRUTE FORCE")

Establish when the brute force ran, whether it succeeded (a failures→success correlation), and which account was cracked. Then correlate with access.log to see what the attacker did after getting in.

# correlation: did the attacker's failures turn into a success?
attacker_events = sorted([r for r in records if r["ip"] == attacker],
                         key=lambda r: r["ts"])
fails = [e for e in attacker_events if e["result"] == "Failed"]
success = next((e for e in attacker_events if e["result"] == "Accepted"), None)

print(f"🥈 Brute force: {fails[0]['ts']} → {fails[-1]['ts']} ({len(fails)} attempts)")
if success:
    print(f"🥈 CRACKED account '{success['user']}' at {success['ts']}")

# what did they do after? (web log, same IP)
import re
WEB = re.compile(r"(?P<ts>[\d\- :]{19}) (?P<ip>\S+) (?P<method>\S+) "
                 r"(?P<path>\S+) (?P<code>\d+)")
print("🥈 Post-compromise web activity:")
for line in sorted(open("access.log")):
    m = WEB.search(line)
    if m and m["ip"] == attacker:
        print(f"     {m['ts']} {m['method']} {m['path']} → {m['code']}")

Bring in the third source — the file-integrity report — to determine what was left behind, and assess impact. Cross-reference: does the FIM finding match the web activity?

fim = open("fim_report.txt").read()
print("🥇 File integrity findings:\n", fim)

# Cross-reference: shell.php appears in BOTH the FIM report (ADDED)
# and the web log (POST/GET) — confirming a webshell was uploaded AND used.
# The MODIFIED index.php suggests defacement or a backdoor injection.
# The 403 on /etc/passwd shows an attempt to read system accounts (failed).

print("""
🥇 IMPACT ASSESSMENT
  - Account 'admin' compromised via SSH brute force.
  - Webshell uploaded (uploads/shell.php) and accessed → remote code execution.
  - index.php modified → possible backdoor/defacement.
  - Attempted /etc/passwd read (403, blocked) → enumeration attempt.
  Scope: this web server + the 'admin' account. Assume full server compromise.
""")

You ran a real incident investigation: parse three log sources, detect the brute force, correlate failures→success→webshell across auth, web, and FIM logs, and report with scope, impact, and remediation. The decisive move was corroboration — shell.php appearing in both the file-integrity report and the web log turned suspicion into proof. This is the daily work of a SOC analyst, built entirely from Lessons 22-25. Tally your medals, and note which step you found hardest — that's where to practise.