Case file
Watchtower
A public shipment portal takes a burst of SQL injection attempts, and a web shell may follow. Confirm whether it's real, whether it landed, and escalate.
- Difficulty
- beginner
- Estimated time
- About 40 minutes
- Learning Path
- Analyst Foundations
- Plan
- Pro
- Telemetry you will work with
- Web logs · Linux · Suricata
- Skills you will use
- SIEM search · Evidence and reporting
- ATT&CK tactics
- Initial Access · Persistence
The full briefing (your role, what is already known, and who to contact) opens when you launch the case. Sign in to launch it and track your progress.