DarkGate via Microsoft Teams: External Message Lure
An IT helpdesk coordinator at a logistics firm receives an urgent Teams chat from an external IT support account. The message links to a VBS script disguised as a VPN update. Running it kicks off a silent MSI install that drops a renamed AutoIt3 loader, which decrypts DarkGate in memory, registers a scheduled task for persistence, and begins beaconing to an HTTPS C2 server. Trace the chain from the Teams lure through the loader to the active backdoor.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Trace the first contact
15The workstation alert trail leads back to a file the user ran from her Downloads folder. Before the file appeared there, someone sent it to her. Work out which channel delivered the lure and recover the external account behind it.
Name the lure file
15The external message contained a link to a file the sender wanted the user to open. Understanding exactly which file was delivered is step one in reconstructing the execution chain.
Find the staging server
20Running the lure file did not deliver the final payload directly. Instead, the script reached out to an external host to pull a second-stage installer. Identify the IP address it contacted.
Expose the loader binary
20The installer dropped a non-standard executable into a ProgramData subdirectory and immediately executed it with a script argument. Identify that executable by name.
Locate the persistence mechanism
20Once the loader was running, it immediately created a mechanism to survive reboots. Identify the name of the scheduled task it registered.
Cut the C2 channel
20The loader established an encrypted command-and-control channel to external infrastructure. To contain the host and block the channel, identify the domain it is beaconing to.
Classify the installer evasion technique
20For the incident report, classify how the attacker used a trusted Windows binary to execute their malicious installer without triggering obvious alerts. Map this to its MITRE ATT&CK technique.
7 tasks · 130 points total
Training Tools
XDR Console
Endpoint detection & response
SIEM Console
Log analysis & SPL queries
Email Console
Email header & content analysis
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
- Familiarity with Email concepts
Ready to investigate?
More Operations
View allAWS S3 Ransomware: SSE-C Encryption (Codefinger)
Client deliverables and backups at a professional-services firm are silently re-encrypted overnight using a legitimate AWS storage feature. No malware runs on any host. Working through CloudTrail, piece together how stolen service-account keys were used to install a countdown clock and lock every object behind a key only the attacker holds.
AsyncRAT: Malvertising to Trojanized Installer
An IT admin searching for a remote management tool clicks a paid search advertisement and downloads what appears to be a legitimate installer. The ZIP contains an AutoIt-compiled fake setup executable that drops a PowerShell loader, which fetches AsyncRAT from a staging server. The RAT establishes persistence via a scheduled task and beacons to a C2 server. Correlate web proxy records, Windows event logs, XDR file and process artifacts, and firewall egress traffic to trace the full chain from malvertising lure to active command-and-control.
BazarCall: Callback Phishing to Remote Access
An accounts-payable coordinator received a spoofed subscription invoice with no attachment and no link -- just a phone number to call. The call center talked her into installing a remote-management tool, and from there the operator moved fast: enumeration, a persistence scheduled task, a Cobalt Strike stager, and a pivot attempt toward the domain controller. Reconstruct the chain from the lure email through the RMM session and the second-stage beacon.