Nothing Like An Nmap

Network

Estimated Time

20

Difficulty

Easy

Point Value

10

Query Languages

SPL

Challenge Description

Your network engineer has stated there is malicious traffic appearing on the network. One machine in your network might be compromised as it has been seen scanning multiple hosts and ports - can you identify the machine?

Log Source Types

Firewall Logs

MITRE ATT&CK Techniques

T1595 - Active Scanning
T1592 - Gather Victim Host Information
T1590 - Gather Victim Network Information

Getting Started

1

Sign in or create an account to begin the challenge

2

Review the challenge description and log types

3

Click "Start Challenge" to begin your investigation

Ready to start the challenge?

Head to the workspace to begin solving