Cloud Identity Under Siege
Nine days of telemetry from a cloud-first Azure estate: Entra ID sign-ins, Windows endpoints, a Kubernetes cluster, an Azure Function and the storage accounts behind them all report into one SIEM. Something inside that window does not fit the shape the estate normally has. Work the SIEM, XDR, firewall and cloud panels together, pin each observation to a host and a principal you can name, and rebuild the sequence from the records themselves.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Establishing the Baseline for Successful Authentication
5Before you can separate anomalous sign-ins from normal activity you need a reliable signal for what a clean, successful interactive logon looks like in the Windows security log. Examine marcus.aurelius's early sign-ins on corp-wks-8821 at the start of the window and determine the numeric Windows event identifier that records a successful logon. Every later sign-in in this dataset carries the same identifier, so pinning it down now is what lets you triage the rest.
Tracing an Unexpected Inbound Connection to the App Server
5With a trustworthy logon signal established, widen out from the workstation into the cloud estate. Azure NSG flow logging recorded an inbound connection reaching the production application server srv-app-prod-01 that does not match the traffic profile the rest of the estate sends it. Open the CLOUD panel, find that inbound flow event, and identify the internal source IP the connection originated from.
Locating the Internal Origin of the Break-Glass Sign-In
5The Azure AD sign-in logs record a successful authentication on the emergency break-glass admin account against production infrastructure, an account the estate's own policy says should almost never be used. The address on that record is internal, not external. Find that sign-in and report the internal source address it came from.
Identifying the Client Used to Reach the Kubernetes API Server
5The container platform is next. Process and network telemetry on the Kubernetes node k8s-node-primary-01 records more than one process opening a session to the same internal endpoint on port 6443. One of them is not part of the node's own control-plane software. Review the SIEM process and network-connection events for that host and name the executable behind that session.
Recovering the Staged Directory-Enumeration Output
10Process-creation telemetry on corp-wks-8821 records a Microsoft Graph directory-enumeration run under the dev_ops_automation service account, with its standard output redirected to a file on disk. Working from the process-creation and file-creation telemetry for that host, recover the full output path the run wrote to.
Recovering the Staged Kubernetes Secrets File
5Days after the directory enumeration, endpoint telemetry on corp-wks-8821 records a process running under marcus.aurelius writing Kubernetes cluster material to a local temporary directory. Find the process-creation and file-creation telemetry for that write and recover the full path the cluster secrets were staged to.
Identifying the Configuration File Copied off the App Server
10Endpoint telemetry then records a small file being pulled off srv-app-prod-01 over HTTP and written into a local Temp directory on corp-wks-8821. Examine the process-creation and file-creation telemetry for that transfer and name the exact artifact that landed in Temp.
Determining the Perimeter Verdict on the Outbound Connection
5One question is left for the incident report: did the perimeter stop anything. Around the time an unrecognised binary on corp-wks-8821 resolved a public blob-storage hostname, the firewall recorded an outbound connection from that workstation to an external destination. Inspect the firewall record for that egress and report the verdict the perimeter applied to it.
8 tasks · 50 points total
Training Tools
SIEM Console
Log analysis & SPL queries
XDR Console
Endpoint detection & response
Firewall Console
Network traffic analysis
Cloud Console
Cloud infrastructure logs
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
- Familiarity with Cloud concepts
Ready to investigate?
More Operations
View allKerberoasting: Service Ticket to Domain Admin
In this scenario, you will investigate a high-speed identity-based attack. Starting from an edge device exploitation, an adversary moves laterally to a domain-joined workstation and targets Active Directory. You must analyze SIEM logs for Kerberos ticket anomalies (RC4 encryption), correlate XDR process trees for Impacket usage, and identify the 'malware-free' techniques used to escalate privileges to Domain Admin.
CI/CD Pipeline Hijack: GitHub Actions Compromise
Investigate the March 2025 GitHub Actions supply-chain compromise involving tj-actions/changed-files and reviewdog/action-setup. A compromised action version tag caused Linux CI runners to execute malicious payload logic and expose CI/CD secrets in workflow logs using double-base64 encoding. Analyze SIEM and XDR telemetry to identify the affected action, runner identity, payload execution, detection source, and secret-exposure pattern, then decide which artifacts are malicious versus benign threat-intelligence lookups.
Search Engine Poisoning: From a Sponsored Result to the Domain Controller
An analyst at a mid-sized logistics firm searched for a routine software update, clicked the sponsored result at the top of the page, and went back to work. Five days later the SOC is holding a workstation, a file server and a domain controller whose telemetry nobody has read yet. You have the SIEM and the endpoint console for those five days, and most of what is in them is an ordinary week. Reconstruct what the click actually started, follow it off the workstation, and put names to the files and the account behind the activity that does not belong.