BazarCall: Callback Phishing to Remote Access
An accounts-payable coordinator received a spoofed subscription invoice with no attachment and no link -- just a phone number to call. The call center talked her into installing a remote-management tool, and from there the operator moved fast: enumeration, a persistence scheduled task, a Cobalt Strike stager, and a pivot attempt toward the domain controller. Reconstruct the chain from the lure email through the RMM session and the second-stage beacon.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Trace the lure
20Something triggered a flurry of endpoint activity today, but the trail starts hours earlier in the mailbox. One inbound message was the catalyst. Find the sender address that delivered it.
Name the tool that opened the door
20After the phone call, the user visited a download page and installed something that gave the other party control of the workstation. Identify what was installed.
Identify the persistence mechanism
20Before moving to the next phase, the operator made sure the access would survive a reboot or a dropped session. Classify the persistence technique by its MITRE ATT&CK identifier.
Track down the staging domain
25Later in the session the operator fetched a second payload onto the workstation. Identify the external domain that hosted it.
Confirm the second-stage payload
20The staged executable was designed to blend in with Windows components. Identify it by the filename the attacker chose.
Determine the intended next target
25Immediately after establishing the second-stage beacon, the operator attempted to move laterally inside the network. Identify the internal host that was targeted.
6 tasks · 130 points total
Training Tools
Email Console
Email header & content analysis
XDR Console
Endpoint detection & response
SIEM Console
Log analysis & SPL queries
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Email concepts
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allAsyncRAT: Malvertising to Trojanized Installer
An IT admin searching for a remote management tool clicks a paid search advertisement and downloads what appears to be a legitimate installer. The ZIP contains an AutoIt-compiled fake setup executable that drops a PowerShell loader, which fetches AsyncRAT from a staging server. The RAT establishes persistence via a scheduled task and beacons to a C2 server. Correlate web proxy records, Windows event logs, XDR file and process artifacts, and firewall egress traffic to trace the full chain from malvertising lure to active command-and-control.
Spring4Shell: Class-Loader RCE to Webshell (CVE-2022-22965)
An internet-facing Java Spring MVC application is compromised through CVE-2022-22965 (Spring4Shell), a class-loader manipulation flaw that turns Tomcat's own logging system into a webshell writer. Working from the Tomcat access logs and the perimeter firewall, trace the exploit request, identify what landed on disk, follow the operator's command sessions, and catch the pivot to an internal backend service.
Cisco IOS XE Web UI: Implant and Rogue Admin (CVE-2023-20198)
The Cisco IOS XE Web UI management interface on AXFORD-RTR-01 was inadvertently exposed to the internet. An attacker exploited CVE-2023-20198 to create an unauthenticated privilege-15 local account, then chained CVE-2023-20273 to drop a Lua implant on the device flash filesystem. The implant hooked the HTTP server and beaconed to an external C2 address. Reconstruct the full compromise chain from the router syslog and the perimeter firewall.