Overnight on the DMZ Wiki
Quillon Software publishes its engineering wiki straight to the internet from the DMZ. Overnight the host picked up work nobody rostered: requests that never authenticated, shell activity under a service account, and outbound sessions from a server that normally only talks to its update mirrors. Work the web access logs, the Linux audit trail and the perimeter egress, and reconstruct what reached the host and what left it.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the foothold
20Before any data moved, someone reached the public Confluence wiki without ever logging in. Work the Confluence/Tomcat access logs and isolate the external address behind the unauthenticated requests that carried injected code in the URL.
Identify the running identity
15The injected code did not run as a person, it ran as whatever account the wiki application itself runs under. Identify the service account the executed commands ran as on the host.
Name the planted webshell
20For durable access the attacker did not add a new file that would stand out, they overwrote one that already shipped with the product. Identify the legitimate Confluence file that was overwritten with a webshell.
Expose the credential theft
20With code execution in hand, the attacker went after the credentials the wiki itself stores. Identify the file on disk where the harvested credentials were staged before they left the host.
Trace the exfiltration
20The staged credentials left the building. Correlate the host egress with the perimeter traffic and identify the external address that received the exfiltrated data.
Classify the access
10No credential was phished and no endpoint was infected, the attacker abused the internet-facing application itself. Map the initial breach to its MITRE ATT&CK technique.
6 tasks · 105 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.