IDLE

Security Content Developer

Name: Security Content Developer
Brand: Hacker Labs

INSTANCE: hl-attacksecurity · IP: 10.10.22.32 · us-east-1

TIME02:00:00

Ubuntu

Lab not running

Click Launch above to provision a fresh Ubuntu VM. Takes ~30s.

Submit flag

0/4 objectives

Scenario

Build a Splunk detection, correlation search and alert for a fresh PowerShell attack.

Objectives — click to toggle

Step-by-step walkthrough

1
Ingest the sample log set
Replay the bundled win_ps_attack.json into index=lab via the HTTP Event Collector.
2
Draft the SPL
Detect encoded PowerShell with -enc, hidden window and download cradles.
```
index=lab sourcetype=powershell | regex CommandLine="(?i)-enc |IEX *\(New-Object"
```
3
Promote to a correlation search
Save as 'PowerShell — Encoded Download Cradle', schedule every 5 min over a 10-min window.
4
Tune the alert
Add risk score 60, suppress duplicates per host for 1 hour, attach ATT&CK annotations T1059.001 + T1105.
5
Validate with replay
Run replay_attack.sh and confirm the notable fires within 2 cycles.

Submission requirements

Upload deliverables via the Files tab before claiming points.