Lion Cipher Lab
Audit who logged in and who used sudo
- SOC Analyst / Blue Team
- Beginner
- ~30 min
- Free · no account required
Why it matters
Two of the most common questions a defender answers are 'who is on this machine?' and 'who gained administrator rights, and when?'. Almost every intrusion eventually shows up as an account logging in at an odd time, an unfamiliar user appearing, or an unexpected use of sudo to run something as root. You cannot judge whether a login is suspicious in a vacuum — you judge it against what normal looks like on that specific box. This lab teaches you to read the login and privilege trail on your own machine and to build that baseline, so the day something abnormal happens, it stands out…
What you'll learn
- login auditing
- who / w / last / lastlog
- reading sudo and su events
- journalctl filtering
- establishing a baseline
Steps in this lab
- The idea: a baseline is your best detector
- Who is on the machine right now
- The login history: who has been on lately
- The last time each account signed in
- Who used sudo — the privilege trail
- Failed sudo, su attempts, and the journal
- Put it together: write down your normal
- Why knowing your own box is the whole game