IntermediateSIEMXDRFirewallPRO

Malware Investigation: Emotet Epoch 4 Binary Padding Evasion

Investigate a resurgence of the Emotet botnet (Epoch 4) utilizing advanced defense evasion techniques. Trace the infection from a macro-enabled document to the deployment of inflated DLL payloads designed to bypass sandbox and scan engine limitations through binary padding. Analyze process hollowing of system utilities and the deployment of modular stealer components.

23 tasks

150 points

Pro

Start this operation

Requires a Pro subscription.

View Pro Plans

Free forever — no credit card required

Investigation Tasks

Complete each task by investigating alerts and submitting your findings.

Analyze Initial Macro Execution

SOC{process_name}Hint available

Identify Payload Download Failover

SOC{domain_name}Hint available

Detect File Inflation Evasion

SOC{size_in_mb}Hint available

Investigate DLL Execution Method

SOC{binary_name}Hint available

Identify Brute Force Origin

A series of RDP logon failures followed by a successful authentication suggests a brute-force attack. Identify the external IP address responsible for these attempts on the FIN-WS-04 workstation.

SOC{...}Hint available

Identify Loaded Stealer Modules

SOC{tool_name}Hint available

Analyze Phishing Delivery Vector

SOC{file_extension}Hint available

Trace OneNote Execution Tree

SOC{process_name}Hint available

Identify Evasion Patterns in Archives

SOC{alert_tag}Hint available

Identify Suspicious Task Creation

SOC{task_name}Hint available

Analyze WMI-Based Tasking

SOC{wmi_class}Hint available

Detect Hidden Tasks via Registry Deletion

SOC{registry_value}Hint available

Trace Process Lineage of Persistence

SOC{process_name}Hint available

Identify Discovery Commands

SOC{command}Hint available

Analyze Discovery Lineage

SOC{pid}Hint available

Detect Account Enumeration

SOC{binary_name}Hint available

Inspect Environment Variable Access

SOC{file_path}Hint available

Network Device Reconnaissance

SOC{ip_address}Hint available

Analyze Registry Persistence Key

SOC{key_name}Hint available

Trace Process Execution Proxy

SOC{process_name}Hint available

Investigate Encrypted C2 Traffic

SOC{port_number}Hint available

Correlate Phishing Influx

SOC{minutes}Hint available

Identify Secondary Payloads

SOC{sha256_hash}Hint available

23 tasks · 150 points total

Start investigation

Training Tools

SIEM Console

Log analysis & SPL queries

XDR Console

Endpoint detection & response

Firewall Console

Network traffic analysis

Skills You'll Build

Investigate realistic security alerts

SIEM log analysis

XDR log analysis

Firewall log analysis

MITRE ATT&CK technique identification

Triage decisions: escalate, investigate, or close

Evidence collection and documentation

Job-ready incident response methodology

Intermediate

Requires foundational alert triage skills. Multiple data sources to correlate.

Prerequisites

Basic understanding of security alerts
Familiarity with SIEM concepts
Familiarity with XDR concepts
Familiarity with Firewall concepts

Ready to investigate?

This operation requires a Pro subscription.

View Pro Plans

Free forever — no credit card required

More Operations

View all

BeginnerSIEMXDR

ClickFix: The Fake CAPTCHA Trap

Investigate a modern 'ClickFix' social engineering attack where a user was tricked into executing a malicious PowerShell command via a fake CAPTCHA interface. You will analyze SIEM and XDR telemetry to trace the infection from the initial web lure to the deployment of an infostealer.

30m20 pts

BeginnerSIEMXDR

Phishing Investigation: ZipLine Supply Chain Campaign

Investigate a sophisticated social engineering campaign targeting manufacturing supply chains. You will analyze a 'reversed' phishing flow where attackers use 'Contact Us' forms to trick employees into initiating email conversations, leading to the deployment of the custom MixShell in-memory implant via DNS tunneling.

45m75 pts

BeginnerSIEM

Credential Harvesting: The Lookalike Login

An investigation into a modern phishing campaign targeting critical infrastructure. You will analyze email headers for domain spoofing, identify 'Paste and Run' execution chains, and track the delivery of the LummaC2 information stealer through SIEM logs.

30m20 pts