Brno-v5.rar

Attackers in this challenge often use standard Linux persistence:

The investigation focuses on a compromised workstation (represented by the image inside the RAR). The goal is to identify the , the malicious actions taken by the attacker, and any persistence mechanisms established on the system. 1. Initial Triage & Evidence Collection File Name : brno-v5.rar

: Look for new or modified .service files in /etc/systemd/system/ . brno-v5.rar

: Inspect ~/.ssh/authorized_keys for unauthorized public keys. D. Network Artifacts

: Change all system passwords and revoke suspicious SSH keys. Attackers in this challenge often use standard Linux

Using , the following artifacts are typically prioritized:

: Often involves a web-facing vulnerability (like an outdated CMS or weak SSH password) leading to a Reverse Shell . Initial Triage & Evidence Collection File Name : brno-v5

: Identifying a .tar or .zip archive created by the attacker containing sensitive data (e.g., /etc/shadow or user documents). 4. Remediation Recommendations