The quiet hour
Below is an excerpt from an authentication log on a made-up server. Something happened here that a rate limit would not have caught, because the atta…
Labs
6These run in your browser against artefacts we made up. Nothing here touches a real system, and no finding on this site is ever used as lab material.
Easy · 10 points
Easy · 15 points
A name that is nearly right
One of the domains below is not what it appears to be. It uses a character that renders like a Latin letter but is not one — the technique behind most…
Easy · 15 points
The one that asked once
A day of DNS queries from one office network. Nothing here is flagged, nothing is known-bad, and searching for something suspicious will not find it. …
Medium · 20 points
Forty alerts a day
A week of alert counts from four detection rules, with what each one turned out to be after review. One of these rules is actively harmful: it is tra…
Medium · 20 points
Two clocks disagree
A file's own timestamps, and the firewall record of the session that supposedly created it. The file claims to have been written before the connectio…
Medium · 25 points
Who is really signing this?
Below is a set of DNS records for a made-up domain that is having trouble with spoofed mail. There is exactly one reason mail claiming to be from thi…