The key that let itself back into the Northwind build host Start this lab

Why this matters

Key-based access leaves almost no noise. There is no failed-password spray, no malware on disk at logon time — just a line in a file the service account owns. This case trains the habit of reading trust stores as evidence, and of following one rogue logon into the two changes it made while it was root.

Concepts

Objectives graded

• Work an Ubuntu build host with bash: auth.log, cron.d, sudoers.d, ps and ss
• Prove the key-based access path, the scheduled callback and the privilege escalation
• Contain the host and the service identity under approval, then record root cause

MITRE ATT&CK coverage

An attacker appends their own key to a build service account's authorized_keys, drops a NOPASSWD sudoers file, and installs a cron job that beacons out every nine minutes from the CI host.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20 · T1098.004 Account Manipulation: SSH Authorized Keys (Persistence)

• A consequential action passed through a human approval gate.

  safety · weight 15 · T1098.004 Account Manipulation: SSH Authorized Keys (Persistence)

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10 · T1053.003 Scheduled Task/Job: Cron (Persistence)

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10 · T1098.004 Account Manipulation: SSH Authorized Keys (Persistence)

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15 · T1078 Valid Accounts (Defense Evasion)

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10 · T1053.003 Scheduled Task/Job: Cron (Persistence)

• The analyst worked the build host directly instead of grading the alert text.

  investigation · weight 10 · T1098.004 Account Manipulation: SSH Authorized Keys (Persistence)

• The rogue key was identified by its comment, so the access path is provable.

  investigation · weight 10 · T1098.004 Account Manipulation: SSH Authorized Keys (Persistence)

• The external peer was proven from auth.log and the live socket table.

  investigation · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The scheduled callback was located, so containment removes the re-entry path.

  behavior · weight 10 · T1053.003 Scheduled Task/Job: Cron (Persistence)

• The live beacon was identified by PID before anything was contained.

  behavior · weight 10 · T1071.001 Application Layer Protocol: Web Protocols (Command and Control)

• The compromised build host is isolated at end state.

  behavior · weight 15 · T1098.004 Account Manipulation: SSH Authorized Keys (Persistence)

• The CI service identity whose key was trusted is disabled pending rotation.

  behavior · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The NOPASSWD drop-in was found, so the account cannot regain root after cleanup.

  behavior · weight 10 · T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching (Privilege Escalation)

• Root cause is recorded as the unpatched CI version carrying the advisory.

  explanation · weight 10 · T1098.004 Account Manipulation: SSH Authorized Keys (Persistence)

• A post-incident timeline was filed: key added, sudoers drop-in, cron install, first beacon, containment.

  explanation · weight 15 · T1098.004 Account Manipulation: SSH Authorized Keys (Persistence)

• The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.

  investigation · weight 5

• The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.

  investigation · weight 3

• Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.

  investigation · weight 3

Common mistakes

• Treating the key comment as identity instead of as attacker-controlled text.
• Filing the cron entry text instead of the full path under /etc/cron.d.
• Killing the beacon and closing the case while cron re-runs it nine minutes later.
• Isolating dev-ws07, which held a legitimate developer session.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.