SOC Analyst studentsAdvancedWazuh · Linux · nginx
The quiet miner
web-01 is at 99% CPU and checkout is slow. Something is running that shouldn't be, and it comes back when you kill it.
C
Chiamaka · SOC shift lead
FIM flagged a new binary under /tmp on web-01, and there's an outbound connection on port 3333. Ops say the box is pegged. Find it, kill it for good, and classify it.
15:00 timed challenge. Available inside the SOC Analyst course. Want to try one now? Play “Knocking at the door” free →
Go further
Learn this properly in SOC Analyst.
Enrolled students get every lab in the course, saved progress and scores, and live sessions where instructors walk through how they'd handle each incident.