thinQtankLABS

Detection Engineering & Incident Response: CVE-2026-43284 & CVE-2026-43500

Respond to a local privilege-escalation compromise on a host exposed to two related kernel bugs (CVE-2026-43284 and CVE-2026-43500). Reconstruct the timeline, find the attacker's persistence, engineer one detection rule covering both vulnerable subsystems, then contain, eradicate, patch both with one update, verify and report.

Intermediate 21 guided steps 6 tasks About 80 minutes Runs in your browser

Skills you will practice

  • Auth and audit log correlation
  • Timeline reconstruction
  • Indicators of compromise
  • Detection engineering across multiple subsystems
  • Containment and eradication
  • Incident reporting

Certifications this lab maps to

This lab builds hands-on skills that appear on these certification exams. thinQtank Learning runs instructor-led training camps for each — click one to see upcoming classes.

CompTIA CySA+ CS0-003 Log analysis, detection and IR Training at thinQtank Learning EC-Council Certified Incident Handler E|CIH Incident-handling lifecycle Training at thinQtank Learning EC-Council Certified Ethical Hacker CEH Privilege-escalation techniques and IOCs Training at thinQtank Learning ISC2 CISSP CISSP Security Operations domain Training at thinQtank Learning
Part of these certification lab packages: CySA+ CS0-003 Linux+ XK0-005 CISSP Certified Ethical Hacker (CEH) CEH Certified Incident Handler (E|CIH) E|CIH GCIH GCIH GCIA GCIA

The scenario

Two kernel privesc bugs (CVE-2026-43284, CVE-2026-43500) are open on this shared host. Overnight the SIEM correlated a local user using a vulnerable subsystem from /tmp, then /etc/shadow written, then a root shell. You are the responder.

What you will do

  1. Open and classify the incident4 steps

    Open the incident · Read the alert · Read the ticket · Classify it

  2. Reconstruct the timeline4 steps

    Pull the user’s auth events · When did root appear? · Correlate the audit log · Which file was corrupted?

  3. Impact and persistence3 steps

    Inspect the sudoers drop-in · What persistence? · Record IOCs

  4. Engineer a detection rule for both4 steps

    Study the sample · Write one rule for both · Test and tune · Why one rule for both?

  5. Contain, eradicate, verify4 steps

    Remove persistence · Patch the kernel (fixes both) · Verify the host · Confirm detection holds

  6. Report2 steps

    Write the report · Why eradicate before closing?

How this lab works

A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.

A file browser where you can place evidence into the lab, either the file provided or one of your own.

Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.

Progress saves after every step. Close the tab and come back later; your files and answers are waiting.