Phishing foothold → domain compromise
A finance user at Vendt Aerospace opened a mail attachment mid-morning, and within the hour an administrative account was signing in to a server it had no business reaching. Work the domain controller's authentication records and the endpoint process telemetry, separate the intrusion from an estate that produces plenty of traffic that looks similar, and reconstruct how the operator got from one workstation to the directory.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the roastable account
50An aerospace domain saw a flurry of Kerberos ticket activity against one account mid-morning, all of it carrying telltale legacy settings. Work the domain controller's authentication records and identify the account the tickets were requested for.
Locate the origin host
50That ticket burst did not come from nowhere. Pin down the internal workstation the requests were driven from so it can be isolated.
Name the process hiding the operator
45The command-and-control on that workstation was not running where you would expect it. Identify the trusted Windows binary the operator hid inside.
Trace the beacon
45Before any of the Active Directory abuse, the foothold called home. Follow the endpoint network telemetry and name the external destination the loader first beaconed to.
Follow the pivot to the core
45With recovered credentials in hand, the operator moved off the workstation onto the directory's most sensitive system. Identify the host they reached by remote desktop.
Classify the credential-access technique
50Summarize for the incident report how the operator obtained the first set of credentials. Map the core credential-access move to its MITRE ATT&CK technique.
6 tasks · 285 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.