Lab 10: "How Did They Get Caught?"
Reconstruct a fictional actor from logs, metadata and operational-security mistakes, and assess the attribution evidence.
The brief
Reconstruct a fictional threat actor from a set of logs, infrastructure metadata and operational-security mistakes, and assess how confidently the evidence supports that attribution.
The course’s final lab turns to the mistake side of operational security: attribution, infrastructure hygiene, and the logs, metadata and human errors that allow defenders to work backward from an operation to the people running it.
Given a set of well-documented operational-security failures as a model, students reconstruct a fictional actor from the supplied evidence and write an assessment of how confidently that evidence actually supports the attribution, the same question every real “how did they get caught?” case ultimately turns on.
What you submit
- A reconstruction of the actor from the supplied logs and metadata
- A written assessment of the attribution's confidence level
Due: 19 October 2027 ·Weight: 2% of the course grade
How it is marked
Assessed on whether the attribution is supported by the evidence given, with confidence stated honestly rather than overclaimed.
Key dates
- Submission due: 19 October 2027
The spec
The brief poses the problem and leaves room for a response. The spec is the fixed part: what a marker checks. Some lines can be checked mechanically; the rest call for judgement.
- submitted by the deadline, in the format named below
- the stated confidence in the attribution matches the strength of the supporting evidence
- reconstructs the actor using only the supplied logs, infrastructure metadata and operational-security mistakes given
- the reconstruction reflects the operational-security failures used as its model, without inventing detail beyond that evidence
- the confidence assessment is honest about what the evidence does not establish, not only what it does