Phishing foothold → domain compromise
A finance user at Vendt Aerospace opened a mail attachment mid-morning, and within the hour an administrative account was signing in to a server it had no business reaching. Work the domain controller's authentication records and the endpoint process telemetry, separate the intrusion from an estate that produces plenty of traffic that looks similar, and reconstruct how the operator got from one workstation to the directory.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the roastable account
50An aerospace domain saw a flurry of Kerberos ticket activity against one account mid-morning, all of it carrying telltale legacy settings. Work the domain controller's authentication records and identify the account the tickets were requested for.
Locate the origin host
50That ticket burst did not come from nowhere. Pin down the internal workstation the requests were driven from so it can be isolated.
Name the process hiding the operator
45The command-and-control on that workstation was not running where you would expect it. Identify the trusted Windows binary the operator hid inside.
Trace the beacon
45Before any of the Active Directory abuse, the foothold called home. Follow the endpoint network telemetry and name the external destination the loader first beaconed to.
Follow the pivot to the core
45With recovered credentials in hand, the operator moved off the workstation onto the directory's most sensitive system. Identify the host they reached by remote desktop.
Classify the credential-access technique
50Summarize for the incident report how the operator obtained the first set of credentials. Map the core credential-access move to its MITRE ATT&CK technique.
6 tasks · 285 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allBrixton Foods: the directory answered a request it should have refused
A food manufacturer's help desk raised a ticket at lunchtime: an overnight production report had not written to the file share, and one workstation had been slow all morning. By the evening the share was unreadable and an administrator account nobody on the IT rota recognises had been busy on the domain controllers. You have the day's Windows Security feed and the endpoint telemetry for the estate. Reconstruct what the operator did between the first mailbox and the unreadable share, and name the accounts and hosts the response team has to act on.
AD CS ESC1: Certificate Template Abuse to Domain Admin
An ordinary user becomes a Domain Admin without stealing a password. A misconfigured certificate template lets the enrollee supply the subject, so the user requests a certificate whose Subject Alternative Name names a Domain Admin, and the CA issues it. The forged certificate is then used for PKINIT to authenticate as that admin. Work the certificate-authority records, the endpoint process tree, and the domain controller's Kerberos logs to reconstruct the escalation.
Ivanti Connect Secure: Auth Bypass to Webshell
An internet-facing Ivanti Connect Secure VPN appliance has been exploited through a pair of chained zero-days: an authentication bypass and a command injection. A webshell is now resident on the appliance, credentials have been stolen from the system configuration, and the attacker has pivoted inward. Work from the SIEM access logs, the Linux host audit trail, and the XDR process tree to reconstruct the chain from the first bypass request to the internal pivot.