Home / Labs / Build the IOC List

Build the IOC List

The investigation is done. Build the IOC list to hunt the same threats across 200 other servers.

Open this lab

Commands practised here

• grep 'Failed' /var/log/auth.log | awk '{print $11}' | sort -uLists unique attacker IPs.
• grep 'Accepted' /var/log/auth.logShows all successful logins with timestamps.
• grep 'Failed' /var/log/auth.log | awk '{print $9}' | sort -uLists unique targeted usernames.
• echo 'IOC Report' && grep -E 'Failed|Accepted' /var/log/auth.logShows all attack and breach events.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Threat Hunter: Incident Report
• Protect the Logs