Lingering in the Background: BITS Job Used for Download and Persistence
A teller workstation was cleaned by antivirus, yet the operator's foothold survived. The malware had abused the Background Intelligent Transfer Service: a self-contained BITS job with a SetNotifyCmdLine notification command re-downloads a payload and re-launches it with regsvr32 every time a transfer completes, then deletes its tracks, leaving only the job entry inside the service state database. Reconstruct the persistence loop from BITS-Client operational events, Sysmon process lineage, and endpoint XDR telemetry, prove it outlived the file-based cleanup, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Identify the persistence job
35Everything that follows hangs off one object the teller's session created. Identify the name of the job that holds the persistence.
Classify the persistence technique
30Name the MITRE ATT&CK technique for the mechanism the operator used to persist on the host.
Recover the executed payload
35When the transfer completed, the job ran something. Provide the full path of the payload it executed.
Classify the proxy-execution technique
30The payload did not run as itself. Identify the MITRE ATT&CK sub-technique for how it was launched through a trusted system binary.
Prove the foothold survived the cleanup
35The host was declared clean, yet the persistence kept working. Identify the external host it reached after remediation.
Recover the payload indicator
35Pin down a huntable file indicator for the BITS-delivered payload so it can be swept fleet-wide. Provide its SHA-256.
7 tasks · 200 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allFrom OneNote to RansomNote: A .one Attachment to Nokoyawa Ransomware
A phishing email carrying a malicious OneNote (.one) attachment delivered the IcedID loader, which beaconed quietly for weeks before the operator launched Cobalt Strike, enumerated Active Directory with AdFind, installed AnyDesk for redundancy, moved laterally over RDP, exfiltrated data over SFTP, and deployed Nokoyawa ransomware on the backup and file servers. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Staged and Gone: Rclone Bulk Upload to MEGA From a File Server
A pre-ransomware bulk data-exfiltration investigation. After a perimeter foothold and hands-on command and control, the operator pivoted to a Windows file share server, recovered a domain-administrator password from a plaintext file, staged finance data into a single archive, and bulk-uploaded it to a MEGA cloud remote with a renamed rclone client over HTTPS before any encryptor ran. The organization also runs rclone legitimately on its backup server, so the challenge is separating the sanctioned job from the theft. Reconstruct the staging-then-upload chain from SIEM and perimeter firewall telemetry.
Trigona Ransomware: Rclone-to-MEGA Cloud Exfiltration
A fast, RDP-only, hands-on-keyboard intrusion that went from a valid Administrator logon on an exposed RDP gateway to estate-wide Trigona ransomware in under three hours. The actor dropped a batch-script and Netscan toolkit, enumerated the network and file shares, pivoted over RDP, disabled Windows Defender by hand, exfiltrated file shares to MEGA cloud storage with a renamed rclone client, then staged and ran the Trigona encryptor over SMB. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.