A junior analyst ran a quick directory listing of the suspect's home folder and reported it clean. Identify the hidden file that does not belong to the default Linux user profile. (Submit the full filename including any leading characters)

A staging directory was found in /tmp. The analyst ran standard checks on the files inside. One file is not what its name suggests. What is the true file type of the imposter? (Submit the primary file type descriptor)

A script in /usr/local/bin/ claims to be a routine utility installed months ago, but something about the timestamps does not add up. When was the file actually created? (Format: YYYY-MM-DD HH:MM:SS)

The auth.log shows a flurry of failed login attempts. What IP address was the attacker connecting from?

You've filtered auth.log for the suspect IP. Buried in the noise is evidence of a successful breach. What is the exact timestamp of initial access? (Format: Mon  D HH:MM:SS as shown in syslog)

The attacker's bash history was recovered despite an attempt to clear it. Careful analysis reveals steganography was used. What passphrase was used to embed the hidden data? (Exact value, case-sensitive)

Every account on a Linux system has a numeric identifier. What is the UID assigned to the threat actor's account? (Submit the number only)

The attacker installed an SSH public key for password-free re-entry. SSH keys carry a comment field that often identifies the originating machine. What is the user@host comment on the attacker's authorized key? (Format: user@hostname)

Attackers target accounts with elevated privileges. One non-root human user on this system belongs to a group that grants administrative command execution. Which username has this elevated access? (Submit the username only)

A suspicious file in the attacker's Downloads folder appears to be encoded. Decode it to reveal the attacker's exfiltration instructions. What port number is specified for the data drop? (Submit the number only)

The disguised executable in the staging directory contains hardcoded network indicators. Extract the readable strings from the binary. What port number is embedded for the reverse shell callback? (Submit the number only)

The attacker's SSH known_hosts file records servers they have connected to. One entry reveals the true public IP address behind the C2 domain. What is it? (Submit the IP address only)

The web server hosts a promotional image. Forensic analysts always check image metadata for hidden information. Examine the EXIF data of the promotional image. What flag is hidden in the metadata? (Submit the full flag including wrapper)

The same promotional image may contain more than just pixels. A deeper scan reveals data appended beyond the image boundary. What is the name of the file hidden inside the image? (Submit the full filename with extension)

Forensic carving requires knowing exactly where embedded data begins. At what byte offset (decimal) does the hidden archive start within the promotional image? (Submit the number only)

The attacker's command history reveals that steganography was used to embed secret data inside an image. Use steghide with the correct image file and passphrase to recover the hidden content. What is the flag inside the extracted data?

The attacker scheduled a task to run automatically. Check the suspect's cron configuration. What is the full absolute path of the script that is scheduled to execute? (Submit the complete file path)

Beyond cron, attackers can persist through shell initialization files. One user's shell configuration contains a hidden command that executes on every login. What domain does this covert callback contact? (Submit the domain name only)

The persistence script creates temporary archives before exfiltrating them. A remnant staging file was left behind in /tmp. The filename contains a Unix epoch timestamp. Convert it to a human-readable UTC timestamp using date -d @epoch and submit it. (Format: MM-DD-YYYY H:MM:SS in UTC)

Before analyzing network connections, establish a baseline. How many services are in the LISTEN state on this server? (Submit the number only)

The attacker modified the host firewall to allow inbound traffic on a non-standard port. Examine the iptables rules. What port number did the attacker add an ACCEPT rule for? (Submit the number only)

The attacker downloaded a tool onto this server from their C2 infrastructure. What is the full URL the persistence script was downloaded from? (Include protocol, e.g., https://...)

The attacker attempted to destroy authentication evidence before disconnecting. Examine the bash history carefully. What is the exact command they used to wipe the authentication log?

After the attacker cleared the logs, the system logging daemon eventually restarted. Examine /var/log/syslog for evidence. What is the exact timestamp when rsyslogd restarted? (Format: Mon  D HH:MM:SS as shown in syslog)

The attacker used timestomping to disguise a malicious file as older than it really is. Examine the bash history to find the touch -t command. What fake date and time was applied to the file? (Format: YYYY-MM-DD HH:MM:SS)