Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Reconstruct Full APT Attack Stages
Mission
Correlate `edr_process.log`, `proxy_http.log`, `dns_queries.log`, and `dlp_transfer.log` on their shared campaign ID to reconstruct the APT kill chain chronologically. Retrieve the flag from the final EXFILTRATION event's campaign tag.
Hints
Hint 1 Show
Four logs (EDR/proxy/DNS/DLP) bury the attacker's actions in legitimate traffic
Hint 2 Show
Each attacker stage carries a shared campaign id op=<hex>; get it from one stage and correlate across all logs
Hint 3 Show
The flag is in the campaign-tag of the final EXFILTRATION stage of the time-ordered kill-chain