by Codelivly
You're the SOC analyst on a live incident: host WKS-ABRAMS is compromised. Four collected artifacts each hide one token tied to an attacker kill-chain phase — Initial Access (phishing email), C2 Beacon (DNS log), Lateral Movement (PowerShell transcript) and Exfiltration (web access log). Reconstruct the attack and recover all four flags. Your own isolated instance — the tokens are unique to you. Submit each CLV{...} in the box; capture all four to complete.
Spin up your own private, isolated instance of this challenge.
Submit each flag below — the box accepts any of them.
Unlocking any hint — including free ones — forfeits the +25% no-hint solve bonus.