Content
The Corelight CTF was a really cool event that really challenged our colleagues technically. They worked their way through Zeek logs, searched for connections in the Investigator, and tried to piece together a coherent picture from individual anomalies. At times, they were pretty convinced they were on the right track. But the next answer would occasionally prove them wrong.
“Our colleagues” refers to Konrad and Aurel. They each competed individually, worked independently of one another, and did not exchange answers. So each had their own queries, their own approaches to solving them, and presumably their own personal moments of doubt as well. Nevertheless, we can all celebrate the results together: first place for Aurel and second place for Konrad. Both spots thus remain within the company.
When the supposedly clear-cut answer is wrong
A challenge like this quickly reveals just how big the difference can be between a plausible explanation and a verifiable answer. Finding a striking connection is a start. Figuring out what happened beyond that—and which systems were involved—takes a little more patience.
Aurel got a little sidetracked here and there. The query returned a result that matched his expectations, and the answer actually seemed unambiguous. Apparently, it wasn’t. So, back to the drawing board: Had he selected the right field? Was he counting connections or different hosts? Did his result even answer the question that was asked?
At moments like that, a brief sense of panic would set in—especially when I’d already spent quite a bit of time following what I thought was a good lead. In hindsight, it’s easy to say that you just have to stay calm and keep searching systematically. But in the heat of the moment, my enthusiasm for that advice is sometimes a bit limited.
But Aurel actually enjoyed that, too. You have to be able to correct yourself and be willing to set aside even a nice explanation. After all, the logs aren’t swayed by how certain you are of your answer at the moment.
An Exciting Journey Through the Data
The tasks led to an exciting journey through the Zeek logs and the Investigator. A DNS query turned into another lead. One connection led to the next log type, and a download raised new questions. Little by little, the individual observations had to be sorted out so that a collection of suspicious events could be turned into a coherent sequence of events.
Time and again, the key was to look closely. A port alone is not reliable evidence of the protocol being used. An alarm name doesn’t automatically tell the whole story. And a field that looks appropriate at first glance may not be what the task is actually asking for.
These are things you generally know. Handling them properly even when under time pressure is a different story. That’s when you quickly realize which steps you’ve really mastered and where you’ve been a little too generous with your own assumptions.
For us, that’s where the great value of such events lies. You try things out, sometimes stumble over a minor detail, and have to figure out the context on your own. When it finally clicks, you retain much more than you would from a solution you simply read about. It’s precisely these experiences that you can carry over into your daily work later on.
Two individual entries, a great success for the company
In the end, we took first and second place on the scoreboard. We’re obviously very happy about that. It’s especially great that Konrad landed right in second place on his own merit. He really delivered a strong performance. Congratulations!
The fact that the top two spots were filled by our own employees makes the result even more satisfying for us. Everyone worked through the tasks on their own and arrived at their answers independently. That means there’s all the more to talk about afterward: Where did you get stuck, which clue was helpful, and at what point did you overcomplicate things?
The results are a great way to wrap things up. But what you’ve learned along the way is just as valuable—if not more so. It’s especially the wrong turns that stick in your mind. You end up taking a closer look at some queries afterward, and hopefully, the next time you analyze them, you’ll question certain assumptions a little sooner.
We’re glad our colleagues participated, and we’d recommend the Corelight CTF to anyone interested in incident response and threat hunting who wants to put their knowledge to the test in a hands-on setting. It was challenging, a bit nerve-wracking at times, and overall, an event that was really fun.
Many thanks to Corelight for the exciting assignments. I’d love to do it again. Those little moments of panic are apparently just part of the deal.
