BTLO: Middle Mayhem
SIEM log investigation · Training lab
I used Splunk to investigate suspicious activity against a web application, tracing reconnaissance, authorization-bypass indicators, reverse-shell attempts, and SSH authentication activity.
Evidence & tools
Evidence: SIEM logs and the lab web application.
Tool: Splunk.