Home / Labs / Rebuild the Timeline

Rebuild the Timeline

Something happened between midnight and 4 AM. Reconstruct what happened and in what order.

Open this lab

Commands practised here

• grep 'Accepted password' /var/log/auth.logShows all successful password logins.
• grep '185.220.101.1' /var/log/auth.log | grep 'Failed' | wc -lCounts failed attempts from a specific IP.
• grep 'disconnect' /var/log/auth.logShows disconnection events.
• grep -E 'Failed|Accepted' /var/log/auth.log | awk '{print $1,$2,$3,$6,$11}' | sort -k1,2 -MShows a sorted timeline of auth events.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Fingerprint the Target
• Threat Hunter: Timeline Reconstruction