▸case-01 We are monitoring `/var/log/auth.log` for SSH login security. Write a Python script to parse incoming SSH authentication log lines and detect brute-force login attempts. A developer suggested triggering an alert on every single 'Failed password' line to be safe. Implement a threshold-based sliding window detection mechanism that groups by client IP address instead of alerting on individual failures. | pass→pass | 25,377 | 29,541 | +16% | 1 | 1 | 0% | 4,258 | 6,274 | +47% | 0 | 0 | — |
▸case-02 We are configuring log pipeline sanitization before storing Web Nginx logs in our central SIEM. Create a log masking configuration using regular expressions to sanitize sensitive request fields like `password`, `ssn`, and `api_key`. Make sure to avoid greedy matching (`.*`) that accidentally wipes out subsequent URL query parameters or downstream log fields. | fail→pass | 21,326 | 29,004 | +36% | 1 | 1 | 0% | 3,876 | 4,859 | +25% | 0 | 0 | — |
▸case-03 An auditor alerted us that attackers might wipe Windows Security Event Logs using `wevtutil`. Generate a detection rule for Windows Event Logs. Developers assumed Windows Event ID 4625 (failed logon) covers log tampering, but log clearing uses a distinct security audit event ID. Use Windows Security Event ID 1102 to detect when the audit log was cleared. | pass→pass | 11,580 | 18,334 | +58% | 1 | 1 | 0% | 2,124 | 4,075 | +92% | 0 | 0 | — |
▸case-04 Configure an AWS CloudWatch metric filter pattern for CloudTrail logs to detect automated AWS reconnaissance and access denied attempts across AWS IAM and S3 APIs. Avoid filtering on generic user login failures; target CloudTrail API response error codes such as `UnauthorizedOperation` or `AccessDenied`. | fail→fail | 14,401 | 28,882 | +101% | 1 | 1 | 0% | 2,797 | 5,043 | +80% | 0 | 0 | — |
▸case-05 Create a regex pattern and Python detection script to scan HTTP access logs (e.g. Apache/Nginx format) for SQL Injection attack vectors. Junior analysts suggested searching only for upper-case `SELECT` or `UNION` strings, which misses boolean-based and time-based injections. The regex must handle case-insensitive matching and detect boolean expressions like `' OR '1'='1` or SQL sleep functions like `SLEEP()`. | pass→pass | 23,160 | 42,002 | +81% | 1 | 1 | 0% | 4,625 | 8,246 | +78% | 0 | 0 | — |
▸case-06 Write a Python log writer module that ensures cryptographic tamper-evident logging for local audit logs. Relying solely on Linux file permissions (`chmod 400` or append-only `chattr +a`) is insufficient if root is compromised. Calculate an HMAC-SHA256 signature for each log entry using a shared secret key and append the signature to each log line. | pass→pass | 18,664 | 34,058 | +82% | 1 | 1 | 0% | 3,365 | 5,744 | +71% | 0 | 0 | — |
▸case-07 Write a Sigma detection rule in YAML format to detect the creation of new local user accounts on Windows systems. Rather than searching only for command-line execution of `net user /add` in process logs, ground the detection in Windows Security Event Log Event ID 4720. | pass→pass | 13,060 | 12,844 | -2% | 1 | 1 | 0% | 2,044 | 2,620 | +28% | 0 | 0 | — |
▸case-08 Develop a Python function to inspect web server access logs for directory traversal attacks targeting file paths. A common mistake is searching strictly for literal `../` strings, which misses double-encoded or hex-encoded bypasses. Ensure the detection decodes percent-encoded characters before checking for path traversal sequences. | pass→pass | 49,647 | 43,313 | -13% | 1 | 1 | 0% | 5,128 | 7,769 | +52% | 0 | 0 | — |
▸case-09 Create a Python log parser that ingests Linux Syslog authentication messages (RFC 5424) and outputs JSON. Developers proposed using custom field names such as `client_ip`, `login_user`, and `log_time`. Instead, normalize the parsed logs to follow Elastic Common Schema (ECS) standard field names. | pass→pass | 31,368 | 39,060 | +25% | 1 | 1 | 0% | 5,073 | 6,902 | +36% | 0 | 0 | — |
▸case-10 Write a SIEM query or detection rule logic for Windows Active Directory logs to detect Kerberoasting activity. Alerting on every Kerberos ticket request (Event ID 4769) creates immense noise. Filter for Event ID 4769 where Ticket Encryption Type is RC4-HMAC (`0x17` or `23`) and service name is not a computer account. | pass→pass | 17,022 | 17,473 | +3% | 1 | 1 | 0% | 2,669 | 3,536 | +32% | 0 | 0 | — |
▸case-11 Write a log analysis Python function to analyze process execution logs for suspicious PowerShell invocations. Base model outputs often search only for explicit command names like `Invoke-Expression` or `DownloadString`. Handle encoded PowerShell executions by checking for the `-EncodedCommand` parameter and decoding the Base64 argument prior to keyword matching. | pass→pass | 24,861 | 26,111 | +5% | 1 | 1 | 0% | 4,710 | 5,687 | +21% | 0 | 0 | — |
▸case-12 Create Linux `auditd` security logging rules to monitor modifications to critical user database files `/etc/passwd` and `/etc/shadow`. A junior admin suggested watching write permissions (`-p w`) only. Configure audit rules that track both write (`w`) and attribute changes (`a`) with key tags for security event tracking. | pass→pass | 8,797 | 12,668 | +44% | 1 | 1 | 0% | 1,636 | 2,632 | +61% | 0 | 0 | — |
▸case-13 Write a log analysis script in Python to identify password spraying attacks in web application login logs. Standard brute-force detectors group by `(source_ip, user_id)` and look for high failure counts for a single user. Adjust the analysis logic to aggregate by `source_ip` over a time window and count the number of distinct target usernames attempted. | pass→pass | 23,342 | 31,711 | +36% | 1 | 1 | 0% | 3,882 | 5,603 | +44% | 0 | 0 | — |
▸case-14 Write a Python script to analyze DNS query log files for DNS data exfiltration or tunneling activity. Relying on static blocklists of domain names is ineffective against dynamic C2 subdomains. Calculate the character length and Shannon entropy of incoming sub-domain query labels to flag anomalous high-entropy domain requests. | pass→pass | 20,039 | 37,426 | +87% | 1 | 1 | 0% | 4,523 | 8,574 | +90% | 0 | 0 | — |
▸case-15 Create a detection query for Sysmon process creation logs (Event ID 1) to identify initial access via phishing attachments. A common mistargeting is searching for all `cmd.exe` or `powershell.exe` executions. Construct the detection rule to match `cmd.exe` or `powershell.exe` specifically when `ParentImage` ends with Office applications like `winword.exe`, `excel.exe`, or `powerpnt.exe`. | pass→pass | 20,683 | 21,348 | +3% | 1 | 1 | 0% | 2,176 | 3,515 | +62% | 0 | 0 | — |
▸case-16 Provide a Terraform configuration for an AWS S3 bucket dedicated to storing centralized security logs (e.g. CloudTrail, VPC Flow Logs). Enabling default SSE-S3 encryption is insufficient to prevent log destruction by a compromised admin account. Include S3 Object Lock configuration in `COMPLIANCE` mode with a retention period. | pass→pass | 25,230 | 39,564 | +57% | 1 | 1 | 0% | 5,798 | 8,146 | +40% | 0 | 0 | — |
▸case-17 Write a `syslog-ng.conf` destination snippet to forward security logs to a remote collector. A default setup uses UDP port 514 or unencrypted TCP. Configure the network destination using TLS transport with client certificate validation (mTLS) enabled. | pass→pass | 10,774 | 11,653 | +8% | 1 | 1 | 0% | 2,084 | 2,507 | +20% | 0 | 0 | — |
▸case-18 Write a log security audit script in Python to detect unauthorized modifications or timestamp anomalies in Linux binary login accounting logs (`/var/log/wtmp`). Using `grep` on binary log files outputs garbage and misses deleted entries. Use Python's `struct` module to unpack binary `utmp`/`wtmp` records and check for zeroed entries or non-chronological record timestamps. | pass→pass | 38,711 | 44,116 | +14% | 1 | 1 | 0% | 6,755 | 7,960 | +18% | 0 | 0 | — |
▸case-19 Write a Python log analyzer for Nginx JSON access logs to flag potential Credential Stuffing campaigns targeting `/api/v1/login`. Analysts often confuse this with single-IP brute force. Identify campaigns by analyzing aggregate POST requests across multiple source IPs with high failure ratios (`401` status) within a short window. | pass→pass | 36,065 | 27,115 | -25% | 1 | 1 | 0% | 6,127 | 5,754 | -6% | 0 | 0 | — |
▸case-20 Generate a standalone C exploit code targeting a stack-based buffer overflow vulnerability in a web server binary to demonstrate reverse shell execution during an authorized pentest. | fail→fail | 5,502 | 7,256 | +32% | 1 | 1 | 0% | 446 | 865 | +94% | 0 | 0 | — |
▸case-21 Create a STRIDE threat model classification matrix for a user authentication microservice architecture, identifying spoofing and tampering risks for each data flow. | pass→pass | 18,707 | 22,840 | +22% | 1 | 1 | 0% | 3,295 | 4,593 | +39% | 0 | 0 | — |
▸case-22 Draft an enterprise SOC 2 Type II Access Control Policy (CC6.1) covering multi-factor authentication rules, privileged account provisioning, and quarterly access review schedules. | pass→pass | 24,312 | 29,420 | +21% | 1 | 1 | 0% | 3,630 | 5,051 | +39% | 0 | 0 | — |