Credential Harvesting: The Lookalike Login
Investigate an adversary-in-the-middle (AiTM) credential phishing campaign that lured an employee to a lookalike Microsoft 365 login page. Working entirely from SIEM logs, you will identify the lookalike domain, reconstruct the multi-hop redirect chain through a compromised legitimate site, uncover a secondary phishing wave against another employee, and confirm account takeover in Azure AD sign-in logs via impossible travel and session-token replay. You finish by choosing the containment action that actually evicts an attacker holding a valid session token. Foundational skills for SOC analysts in lookalike-domain analysis and identity-centric incident response.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Understanding Credential Harvesting
5Start with the concept before touching the logs. Adversary-in-the-middle phishing proxies a real sign-in, captures what the victim types and what the identity provider issues afterwards, then lets the attacker act as an already-authenticated user. Read the setup, then work the steps in order.
The Phishing Domain
10Two messages reached alicia.rodriguez that morning, alongside the ordinary traffic of a working day. Work the email gateway and DNS records below and name the lookalike domain that stood in for a legitimate Microsoft sign-in page.
Tracing the Infrastructure
10Alicia's browser did not stop at the first host it was sent to. Work the network records from her workstation and identify the external server that served the credential form and received what she typed into it.
Secondary Phishing Domain
5One victim is rarely the whole campaign. Widen the search across the environment for the same pattern aimed at somebody else, and name the second domain this actor used.
The Redirect Chain
5The link in the message did not point at the fake login page. Reconstruct the path the browser actually walked and name the host that stood between the click and the lookalike domain.
Confirming the Compromise: Azure AD Sign-In Analysis
10Infrastructure alone does not prove a compromise. Read the Azure AD sign-in records for alicia.rodriguez, establish whether the stolen material was actually used, and identify what the attacker's machine reported about itself when it was.
Containment
5Close the case. Weigh what the evidence actually established against the five actions available to you, and choose the one to take first.
7 tasks · 50 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allClickFix: The Fake CAPTCHA Trap
The ClickFix social engineering technique uses dialogue boxes containing fake error messages to trick victims into copying, pasting, and running malicious content. In this scenario, a user was targeted with a 'Verify You Are Human' CAPTCHA check that led to a significant endpoint compromise. You will analyze the 'paste-and-run' execution chain, investigate PowerShell activity initiated via the Windows Run dialog, and identify the deployment of an information stealer.
QR Code Phishing: Scan to Compromise
In this scenario, you will investigate a modern 'Quishing' (QR phishing) attack that bypassed traditional email filters by hiding its payload inside an image. You will trace the full chain: a spoofed MFA-enrollment lure sent from purpose-built infrastructure, a redirect server that conceals the final destination, and an Evilginx-style adversary-in-the-middle page that stole an authenticated session cookie despite MFA. You will then follow the attacker's post-compromise moves (Graph API mailbox enumeration, SharePoint exfiltration, and a hidden inbox forwarding rule) and choose the containment action that actually evicts them.
MFA Fatigue: The Notification Flood
In this guided walkthrough, you will step into the shoes of a SOC analyst investigating a modern identity-based attack. The threat landscape in 2026 has shifted: adversaries are no longer just 'breaking in'; they are logging in. You will analyze real-time identity signals, correlate disparate log sources across a hybrid cloud environment, and identify the markers of an MFA fatigue attack used by the FlowerStorm phishing kit. This scenario highlights the critical importance of behavioral analysis over simple IOC matching in an era of malware-free intrusions and compromised human identities.