Threat HuntingMediumPro

Lunch Noise

Company: Mercur Retail LLP

35 min7 questions100 pointsMITRE ATT&CK:T1595.003T1590

Briefing

Mercur Retail LLP is a retail chain. The site administrator noticed the daily 404 counter had risen many times over and handed you the access log.

The log also holds ordinary visitors: they browse existing pages and get 200. Your job is to find the client behaving differently and describe it well enough that access can be closed.

Fields follow Elastic naming: source.ip, url.path, http.response.status_code, user_agent.original. Timestamps are UTC.

This lab is part of the subscription

Get Pro to unlock every lab, the tracks and new material each month.

See pricing