Lion Cipher Lab
Triage a compromised Linux host
- Digital Forensics & IR (DFIR)
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Every defender eventually hits the moment this lab is about: a machine is behaving strangely, an alert fired, or file integrity monitoring flagged a change, and someone has to look at the box and decide whether it is actually compromised. That first look is triage, and doing it well is a learnable skill with a specific shape. It rests on two ideas that beginners routinely get backwards. The first is that you observe before you act — you gather evidence before you change anything, because every command you run and every file you touch alters the very system you are trying to understand. The…
What you'll learn
- incident-response triage
- preserving volatile data
- enumerating running processes
- inspecting live network connections
- hunting persistence mechanisms
- reviewing login and account activity
- finding recently modified files
- knowing when to isolate and escalate
Steps in this lab
- The mindset: observe before you act, volatile data first
- Running processes — what is executing right now
- Network connections — who is it talking to
- Persistence — how it survives a reboot
- Logins and accounts — who has been here, and who is here
- Recently modified files — what changed, and when
- Open questions, isolation, and when to hand it off
- Why this half-hour is the one that makes a defender