BazarCall: Callback Phishing to Remote Access
An accounts-payable coordinator received a spoofed subscription invoice with no attachment and no link -- just a phone number to call. The call center talked her into installing a remote-management tool, and from there the operator moved fast: enumeration, a persistence scheduled task, a Cobalt Strike stager, and a pivot attempt toward the domain controller. Reconstruct the chain from the lure email through the RMM session and the second-stage beacon.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Trace the lure
20Something triggered a flurry of endpoint activity today, but the trail starts hours earlier in the mailbox. One inbound message was the catalyst. Find the sender address that delivered it.
Name the tool that opened the door
20After the phone call, the user visited a download page and installed something that gave the other party control of the workstation. Identify what was installed.
Identify the persistence mechanism
20Before moving to the next phase, the operator made sure the access would survive a reboot or a dropped session. Classify the persistence technique by its MITRE ATT&CK identifier.
Track down the staging domain
25Later in the session the operator fetched a second payload onto the workstation. Identify the external domain that hosted it.
Confirm the second-stage payload
20The staged executable was designed to blend in with Windows components. Identify it by the filename the attacker chose.
Determine the intended next target
25Immediately after establishing the second-stage beacon, the operator attempted to move laterally inside the network. Identify the internal host that was targeted.
6 tasks · 130 points total
Training Tools
Email Console
Email header & content analysis
XDR Console
Endpoint detection & response
SIEM Console
Log analysis & SPL queries
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Email concepts
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allQakBot: Email Thread Hijack to Cobalt Strike
A freight coordinator received what looked like a reply from a trusted supplier. Hidden inside the ZIP attachment was a JavaScript dropper that fetched a QakBot DLL, registered it via regsvr32, and injected it into a system process. Minutes later a Cobalt Strike beacon followed, and the operator pivoted to the file server via WMI. Trace the kill chain from the spoofed email thread to lateral movement.
LLMNR and NBT-NS Poisoning: NTLM Relay to SMB
A workstation on the Vantara Solutions network mistyped a file server name. DNS had no answer. Windows broadcast the query over LLMNR -- and something on the network answered. Reconstruct the poisoning, the credential capture, and the relay that followed using SIEM events, endpoint telemetry, and a raw packet capture.
Raspberry Robin: USB Worm to LOLBin Execution
A staff member at Vantekra Solutions inserted an unknown USB drive. The LNK on it silently handed execution to cmd.exe, which called msiexec to fetch a DLL from a compromised host on the internet. rundll32 loaded it, fodhelper provided silent elevation, and a Tor-backed C2 channel opened within minutes. Every step used a signed Windows binary. Trace the full chain through the XDR process tree and Sysmon logs.