# APT Intrusion Investigation (lab)

> A national CERT tells a maritime operator that one of its addresses has been talking to espionage infrastructure. No hashes, no domains, no dates.

Canonical: https://codelivly.com/labs/apt-intrusion

| | |
|---|---|
| Type | Investigation |
| Difficulty | Advanced |
| Points | 500 |
| Session length | 1 h |
| Completions | 3 |

A national CERT tells a maritime operator that one of its addresses has been talking to espionage infrastructure. No hashes, no domains, no dates. The first responder sorted the file system by creation time, found nothing recent, and asked whether the notification might be a false positive. It is not.

## Objective

Learn why file system timestamps cannot be used to date an intrusion, and what to corroborate them against. You will find an artefact that a creation-time sort actively hides, prove its metadata is false using three sources the attacker never controlled, and identify a second command-and-control channel that survives blocking the first.

## Tasks

1. Reproduce the first responder's pass, then distrust it
2. Compare what the disk claims against what was observed
3. Corroborate twice more before you accuse anything
4. Establish the persistence and the evasion
5. Find BOTH channels, and compute dwell honestly

## Related

- [All labs](https://codelivly.com/practice?type=lab)