// Log Analysis & Regex Challenge

Every attacker leaves a trail — grep, sed, and awk are how you find it. Five hands-on log-hunting challenges from the UNG Cyber Unit workshop, ramping from "open the file" to "chain five commands and don't give up."

// Download

Challenge Files (.zip) The 5 target logs used below Regex Quick Reference (.pdf) Printable command & syntax cheat-sheet Workshop Slides (.pptx) Full walkthrough these challenges are drawn from

// Your Toolbox

Seven commands, endless combinations. Full syntax and examples for each are in the quick-reference PDF above.

strings Pull readable text out of binary or garbled data
grep Search text for lines matching a pattern
sed Stream editor — find/replace, extract with capture groups
awk Split lines into columns, filter and compute on them
cut / sort / uniq Slice columns, order output, collapse duplicates and count them
wc -l Count lines — great for turning a search into a number

// The Challenges

Every file is realistic and every answer is verifiable — no trick questions, just regex. Work in teams; each file below is inside the Challenge Files download.

01 Super Easy

Find the Successful Root Logon

This capture has several login attempts mixed into a raw binary dump. Most fail. One succeeds and drops into a shell. Find the frame that shows a SUCCESSFUL root logon — no regex required.

Target file: frame_capture.bin
02 Easy

Identify the Flooding IP

This firewall log shows a flood of authentication attempts from numerous different IP addresses. One IP is hammering it far harder than the rest. Find that IP's address (column 4).

Target file: auth_events.log
03 Medium

Count a User's Ping Attempts

This is a command-audit log of everything every user ran. Find out how many separate lines show the user jdoe attempting to ping a server — of any kind, to any target.

Target file: command_audit.log
04 Medium

Count the Unique SQLi Attackers

This is a web server access log. Somewhere in the noise, a handful of IPs are throwing SQL injection payloads at the login and search forms. How many UNIQUE IP addresses are responsible?

Target file: access.log
05 Hard

Find the Beacon, Then Decode It

About 20 hosts are sending SEQ / PAYLOAD tags hidden across the User-Agent, request path, and Referer fields. Only ONE is a real exfil channel, the rest are decoys with garbage payloads. Figure out which host is real, reassemble its fragments IN ORDER, and decode the hidden message.

Target file: access_exfil.log

// Continue the Hunt

Once you've got grep, sed, and awk in hand, put them to work on a full guided challenge from the CyLab Security Academy library: learn.cylabacademy.org/library/527 ↗