The Ulysses_Lab presents a scenario where a Linux server has been compromised, and it is your responsibility as a security analyst to investigate the incident and uncover the attacker’s activities. Through a combination of forensic techniques and analysis tools, you will examine system artifacts such as memory dumps, log files, and malicious payloads to piece together the chain of events leading to the breach.
This lab challenges you to leverage forensic tools like Volatility and log analysis methods to identify the attacker’s entry point, understand their actions on the compromised server, and determine what was targeted or exfiltrated. Along the way, you will uncover evidence of brute force attacks, exploitation of vulnerable services, and the deployment of malicious scripts used to establish persistence and maintain control over the system.
By methodically analyzing system activity and correlating findings across various sources, you will reconstruct the attack, identify the vulnerabilities exploited, and gather critical indicators of compromise (IOCs) to aid in future prevention efforts. This walkthrough will guide you through each step of the investigation, ensuring a comprehensive understanding of the tools, techniques, and concepts involved in endpoint forensics and incident response.
To determine which account triggered the brute force alert in the Ulysses_Lab, the investigation starts by analyzing the provided disk image, victoria-v8.sda1.img. Using FTK Imager, the disk image is mounted to access its file system safely without altering the data. When mounting the image, ensure that it is set to "Read Only" mode to preserve the integrity of the evidence. Assign a drive letter to the mounted image, allowing it to be explored like a physical drive on the system. This process enables a thorough examination of the contents wit…