# MegaCorp SOC Investigation (CTF challenge)

> You're the SOC analyst on a live incident: host WKS-ABRAMS is compromised. Four collected artifacts each hide one token tied to an attacker kill-chain phase — Initial Access (phishing email), C2…

Canonical: https://codelivly.com/ctf/challenges/soc-megacorp-investigation

| | |
|---|---|
| Category | Forensics & OSINT |
| Difficulty | Insane |
| Points | 6000 |
| Estimated time | 2 h |
| Type | Live instance |
| Solves | 23 |
| Author | Codelivly |

You're the SOC analyst on a live incident: host WKS-ABRAMS is compromised. Four collected artifacts each hide one token tied to an attacker kill-chain phase — Initial Access (phishing email), C2 Beacon (DNS log), Lateral Movement (PowerShell transcript) and Exfiltration (web access log). Reconstruct the attack and recover all four flags. Your own isolated instance — the tokens are unique to you. Submit each CLV{...} in the box; capture all four to complete.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)