Kill Switch: The Eaton Logic-Bomb Sabotage
A malicious-insider sabotage by a demoted senior developer who abused legitimate commit-and-deploy access to the production Java billing platform. He planted an infinite-loop logic bomb that hung the app-server cluster by resource exhaustion, then a kill switch that polled Active Directory for his own account status and, once disabled, deleted other users' AD profiles to lock staff out, before wiping encrypted volumes and the source repository. No phishing, no malware delivery, no external break-in. Reconstruct the full sabotage from SIEM and endpoint XDR telemetry and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find the tainted production artifact
35The first outage was not a capacity problem. Identify the file that was promoted to production and then hung the app-server cluster.
Name the logic-bomb kill switch
35The destructive code identified itself. Recover the Java class name the operator used for the kill switch.
Classify the dormancy mechanism
30The kill switch stayed invisible for weeks before firing. Classify the MITRE ATT&CK technique for how it decided when to detonate.
Pin the trigger event
35One ordinary administrative action satisfied the guardrail and armed the bomb. Identify the account whose status change triggered it.
Classify the lock-out impact
30When it detonated, the kill switch did not encrypt or steal anything; it removed access. Classify what it did to other employees.
Recover the deletion dropper's indicator
35The bulk AD deletion ran from a script the kill switch dropped. Provide the SHA-256 of that dropper so it can be hunted.
Classify the final destruction
30The operator returned the next night to destroy backups and source. Classify what he did to the encrypted volumes and the repository.
8 tasks · 230 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allTRITON: Safety System Sabotage at a Petrochemical Plant
A nation-state-grade ICS intrusion that reaches the deepest protective layer of a petrochemical plant. An attacker reuses remote access to pivot from the DCS network onto a dual-homed Schneider Triconex SIS engineering workstation, transfers the TRITON attack framework (an executable masquerading as the legitimate Triconex Trilog viewer plus a bundled library and two controller payloads), and uses the proprietary TriStation protocol to reprogram a safety controller, until a failed validation check trips an unplanned emergency shutdown. Reconstruct the kill chain from SIEM, endpoint XDR, and firewall telemetry, and classify the ICS impact techniques.
Midnight Blizzard: Malicious Entra App Registration and Service Principal Abuse
A nation-state-style identity-plane intrusion that lives entirely in Microsoft Entra ID and Exchange Online. A low-and-slow password spray across rotating residential-proxy IPs lands on a legacy, no-MFA test account; from there the actor pivots into the application layer, creates a rogue user, registers a new malicious application and service principal, grants it the Office 365 Exchange Online full_access_as_app role plus EWS.AccessAsUser.All, adds a client secret for durable app-only access, and reads corporate mailboxes over Exchange Web Services with no user sign-in. Work the Entra sign-in audit, the application and service-principal lifecycle and role-assignment events, the credential change, and the EWS mailbox operations to reconstruct the chain and classify the key ATT&CK techniques.
OneClik: ClickOnce + AppDomainManager Injection with ETW Patching and AWS-Hidden C2
A ClickOnce-delivered intrusion at an oil-and-gas operator that mirrors nation-state tradecraft. A spearphishing link served a Microsoft ClickOnce deployment that ran under the trusted dfsvc.exe, sideloaded a signed binary whose tampered .config used .NET AppDomainManager hijacking to load an attacker assembly at CLR startup, patched Event Tracing for Windows to blind the sensor, ran anti-debugging checks, and injected a Golang backdoor (RunnerBeacon) that hid its C2 behind AWS CloudFront and API Gateway. Reconstruct the chain from email, endpoint XDR, and cloud audit telemetry, and classify the key ATT&CK techniques.