you> triage auth.log. did anyone actually get in?
agent● reading auth.log … 48,213 lines
agent● 3 hosts show bursts of failures followed by a success
agent● 10.4.7.22 → 312 failures, then success as svc_backup at 02:14
agent● svc_backup is a service account. checking for interactive logins…
agent● none in 90 days. this one matters.
you> show me the raw lines. i don't trust you yet.
Feb 25 02:14:07 bastion sshd[8812]: Accepted password for svc_backup from 10.4.7.22
you> good. now: what did svc_backup do next?
APRES{████████████████} — flags unlock Feb 25, 10:00 AM MST
you>