Project 67: Network Log Intrusion Analysis

Module: Module 7: Wireless, Systems & Mobile Security  |  Level: Intermediate  | 
Primary tool: CyberDefenders free challenge logs  |  Estimated time: 75–120 minutes

Objective: Triage a set of real (sanitized) network logs to reconstruct an intrusion timeline.

Free lab environment

CyberDefenders free forensics challenges + Wireshark Sample Captures — https://cyberdefenders.org/blueteam-ctf-challenges/ and https://wiki.wireshark.org/SampleCaptures

Wireshark’s official wiki hosts a large library of free, legally shareable sample .pcap files for exactly this kind of exercise. CyberDefenders’ free challenge tier includes downloadable evidence files (disk images, logs, memory dumps) with model answers you can self-check against.

Lab workflow

1. Download the evidence file(s) from a free CyberDefenders ‘network forensics’ challenge and verify you have the correct, complete file before analysis.
2. Open it in CyberDefenders free challenge logs and get an overview (protocol hierarchy, file listing, or timeline view) before diving into individual events.
3. Narrow your analysis specifically to triage a set of real (sanitized) network logs to reconstruct an intrusion timeline, using filters rather than manually scrolling through everything.
4. Reconstruct a timeline of at least 3 connected events, in order, with a timestamp for each.
5. State your root-cause conclusion in one sentence, then list the specific evidence that supports it.
6. Package your timeline and conclusion into the report format described below.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• your annotated timeline of events reconstructed from the logs
• your written root-cause conclusion and the single log field that was most decisive

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.