M3HT4-001 THE WEB GATE INTERACTIVE REPLAY
Linux Web Service Intrusion Contained before exfiltration.
A realistic, bounded intrusion storyline that begins with a historical web vulnerability, progresses through post-exploitation discovery and collection, and is contained when the represented command-and-control channel is blocked before exfiltration.
M3HT4-001-BETA 01 / 01
Linux Web Service Intrusion
A realistic, bounded intrusion storyline that begins with a historical web vulnerability, progresses through post-exploitation discovery and collection, and is contained when the represented command-and-control channel is blocked before exfiltration.
SCENARIO COVERAGE T1190 Exploit Public-Facing Application T1059.004 Unix Shell T1082 System Information Discovery T1057 Process Discovery T1083 File and Directory Discovery T1005 Data from Local System T1071.001 Web Protocols
VULNERABILITY CONTEXT CVE-2021-41773 Apache HTTP Server 2.4.49 Critical · CVSS 3.1 9.8 · High-level context only · exploit procedure not published ↗
ATTACK PATH
Initial Access → Execution → Discovery → Collection → Command & Control → Contained
ANALYSIS LENS
Same evidence. Different operational perspective.
INTERACTIVE REPLAY
Scenario timeline
READY
ATTACK PATH
ATT&CK-mapped storyline
Completed Current Outcome
PRE-FLIGHT Scenario preparation The mapped attack path begins with the first adversary behavior.
READY Select a stage to jump to its first event. Discovery and other multi-event stages unfold as you continue the storyline.
00:00 / 04:00
01 / 12 PLATFORM EVENT
00:00 Scenario initialized No ATT&CK mapping
CURRENT MOMENT
Scenario initialized
EVENT 01 / 12 PLATFORM EVENT
BLUE LENS Defensive interpretation
KEY TAKEAWAYS Two essentials first. Expand the workbench when you want the full operational detail.
BLUE DEFENDER WORKBENCH
ANALYST VIEW Investigate, detect & respond
Work the current moment like a defender: establish what happened, prove it with telemetry, assess the detection or control result, and decide what should happen next.
LOG SOURCES & ANALYST PIVOTS
SYNTHETIC / PUBLIC-SAFE What would a defender actually query?
Values shown here are synthetic, documentation-only, or intentionally sanitized. They illustrate investigation pivots without exposing private infrastructure, real credentials, live malicious infrastructure, or exploit request content.
ANALYST DRILL
AUTHORITATIVE REFERENCES
RED OPERATOR CONTEXT
PUBLIC-SAFE Representative tooling & references
Publication boundary
Tool names and official references are shown for educational context only. No exploit syntax, payloads, module identifiers, command sequences, credentials, C2 configuration, bypass instructions, or live-target details are published.
PURPLE VALIDATION LAB
TEAM VIEW Validate coverage & improve the system
Compare Red intent with Blue evidence. The goal is not to declare a winner; it is to prove what was observable, what was detected or prevented, and what the next iteration should improve.
VALIDATION DRILL
AUTHORITATIVE REFERENCES
INVESTIGATION VIEWS
Examine the current moment
Blue-team view: validate telemetry, execution context, network visibility, and detection outcomes.
EVIDENCE
3 ARTIFACTS Artifacts for this moment
SELECTED ARTIFACT Scenario manifest loaded
PROCESS
SYNTHETIC TREE Execution lineage
PROCESS CONTEXT scenario-init
NETWORK
SYNTHETIC POLICY Scenario boundary
◇
No network activity in this moment
The replay stays focused on evidence relevant to the selected event. A network path appears only when network telemetry exists.
◇ M3HT4-LAB-01 Synthetic workload
× BLOCKED HTTPS representation
◎ 198.51.100.25 TEST-NET-2 · Documentation
BOUNDARY DETAIL Scenario isolation intact
The current replay moment contains no network telemetry. The platform does not infer a network event when none exists.
DETECTIONS & CONTROLS
0 / 4 ACTIVE Correlated findings
FINDING DETAIL No finding selected
Findings become active as the replay reaches the supporting evidence.
Public preview boundary
This beta is a static client-side simulation. It cannot execute commands, accept uploads, access the private M3HT4 lab, reach management interfaces, or retrieve live telemetry. The network example uses the documentation-only TEST-NET-2 address range.
Read the M3HT4 Responsible Use & Research Policy →