Lion Cipher Lab
Reconstruct a Linux intrusion from login records and shell history
- Digital Forensics & IR (DFIR)
- Intermediate
- ~60 min
- Free · no account required
Why it matters
When a Linux box is suspected compromised, the first hour decides everything: is this real, when did it start, who got in, and what did they touch? Full disk imaging is slow and sometimes overkill. A responder who can read the login records and shell history on the live box can build a defensible, ordered timeline in minutes and hand it to an IR lead — or rule the alert out. These artifacts are also exactly what attackers try to erase, so knowing where they live, and knowing that a missing record is itself a finding, is core Linux DFIR judgment.
What you'll learn
- Linux forensic artifact map (wtmp / btmp / utmp vs text logs vs shell history)
- Decoding binary login records with last, lastb, and utmpdump
- Reading auth.log / secure for session and sudo corroboration
- Reconstructing an ordered intrusion timeline from independent artifacts
- Recognising and reasoning around anti-forensics (absence of evidence)
Steps in this lab
- The Linux forensic artifact map (read this first)
- Snapshot the box and work on copies, never originals
- Stage the incident — become the attacker for five minutes
- Decode successful logins with last (who, from where, how long)
- Decode failed logins with lastb (the brute-force signal)
- Read the raw records with utmpdump
- Corroborate with auth.log / secure
- Read the attacker's shell history — and check for timestamps
- Find the persistence — accounts and cron
- Assemble the ordered timeline
- The honest limits — absence of evidence is not evidence of absence