Cloud Identity Under Siege
Nine days of telemetry from a cloud-first Azure estate: Entra ID sign-ins, Windows endpoints, a Kubernetes cluster, an Azure Function and the storage accounts behind them all report into one SIEM. Something inside that window does not fit the shape the estate normally has. Work the SIEM, XDR, firewall and cloud panels together, pin each observation to a host and a principal you can name, and rebuild the sequence from the records themselves.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Establishing the Baseline for Successful Authentication
5Before you can separate anomalous sign-ins from normal activity you need a reliable signal for what a clean, successful interactive logon looks like in the Windows security log. Examine marcus.aurelius's early sign-ins on corp-wks-8821 at the start of the window and determine the numeric Windows event identifier that records a successful logon. Every later sign-in in this dataset carries the same identifier, so pinning it down now is what lets you triage the rest.
Tracing an Unexpected Inbound Connection to the App Server
5With a trustworthy logon signal established, widen out from the workstation into the cloud estate. Azure NSG flow logging recorded an inbound connection reaching the production application server srv-app-prod-01 that does not match the traffic profile the rest of the estate sends it. Open the CLOUD panel, find that inbound flow event, and identify the internal source IP the connection originated from.
Locating the Internal Origin of the Break-Glass Sign-In
5The Azure AD sign-in logs record a successful authentication on the emergency break-glass admin account against production infrastructure, an account the estate's own policy says should almost never be used. The address on that record is internal, not external. Find that sign-in and report the internal source address it came from.
Identifying the Client Used to Reach the Kubernetes API Server
5The container platform is next. Process and network telemetry on the Kubernetes node k8s-node-primary-01 records more than one process opening a session to the same internal endpoint on port 6443. One of them is not part of the node's own control-plane software. Review the SIEM process and network-connection events for that host and name the executable behind that session.
Recovering the Staged Directory-Enumeration Output
10Process-creation telemetry on corp-wks-8821 records a Microsoft Graph directory-enumeration run under the dev_ops_automation service account, with its standard output redirected to a file on disk. Working from the process-creation and file-creation telemetry for that host, recover the full output path the run wrote to.
Recovering the Staged Kubernetes Secrets File
5Days after the directory enumeration, endpoint telemetry on corp-wks-8821 records a process running under marcus.aurelius writing Kubernetes cluster material to a local temporary directory. Find the process-creation and file-creation telemetry for that write and recover the full path the cluster secrets were staged to.
Identifying the Configuration File Copied off the App Server
10Endpoint telemetry then records a small file being pulled off srv-app-prod-01 over HTTP and written into a local Temp directory on corp-wks-8821. Examine the process-creation and file-creation telemetry for that transfer and name the exact artifact that landed in Temp.
Determining the Perimeter Verdict on the Outbound Connection
5One question is left for the incident report: did the perimeter stop anything. Around the time an unrecognised binary on corp-wks-8821 resolved a public blob-storage hostname, the firewall recorded an outbound connection from that workstation to an external destination. Inspect the firewall record for that egress and report the verdict the perimeter applied to it.
8 tasks · 50 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
- Familiarity with Cloud concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.