LOG HUNT_

# man log-hunt

Every day there's a fresh 25-line log from a web server, a Linux box, Windows, DNS, AWS or a shell history. One line is the attack. Find it.

• Tap a line, then [ THAT'S THE ONE ]. You get 4 tries.
• Every miss unlocks a hint: the ATT&CK tactic, then where to look, then the technique itself.
• Monday is easy. By Sunday it's nasty, and some lines are red herrings that look bad but aren't.
• Afterwards you'll see what the attack was, its MITRE ATT&CK ID, and why the red herrings were innocent.

The logs are generated, not taken from real victims. The attacks in them are real techniques.

# cat ~/log-hunt/stats