IntermediateSIEMXDR

Finance Mailbox Takeover at MegaCorp Logistics

A finance analyst at MegaCorp Logistics reported that colleagues were receiving replies to messages she never sent, and her account was disabled while the investigation runs. You have the SIEM feed and the endpoint XDR telemetry for the workstation estate and the mail platform, covering the week around the report. Reconstruct what happened: which host produced the endpoint evidence, what its browser reached, how the account was taken over, and what was left behind on the mail platform so the containment plan is complete.

45m

8 tasks

50 points

Free

Start this operation

Investigation Tasks

Complete each task by investigating alerts and submitting your findings.

Scope the Compromised Endpoint

The case opened as a mailbox compromise on a finance analyst's account. Before tracing how the intrusion unfolded you need to scope it: which internal workstation produced the endpoint telemetry behind this incident? Work the SIEM around the automation binary that ran during the browser session and read the host it was recorded on.

SOC{...}Hint available

Trace the Outbound Connection

Having scoped the affected workstation, follow what its browser did during the window in question. Shortly after the user opened a downloaded file, the host opened an HTTPS connection to an external host. Work the XDR timeline and network events and identify the external destination the browser connected to.

SOC{...}Hint available

Classify the First Detection

The connection you traced raised a detection on the affected host in the XDR Behaviors panel. Report the MITRE ATT&CK technique ID the platform mapped to that detection.

SOC{...}Hint available

Classify the Second Detection

A second detection fired on the same host a few minutes after the first, on the artifact the browser was holding at that point. Determine the MITRE technique ID the platform assigned to it.

SOC{...}Hint available

Name the Adversary's Objective

You have now mapped two related techniques on this host. In the ATT&CK model both roll up under a single tactic that describes the adversary's goal in this phase of the intrusion. Report that shared tactic.

SOC{...}Hint available

Identify the Delivered File

With the endpoint activity understood, trace back to how it started. A file arrived by email and was opened from the user's Downloads folder shortly before the browser session. Correlate the inbound mail event with the process that opened the download and identify that file.

SOC{...}Hint available

Identify the Launching Process

Opening that file was followed by a headless automation binary running on the same host. Walk the XDR process tree on the affected workstation and determine which immediate parent process launched that binary.

SOC{...}Hint available

Classify the Mail Server Detection

You have reconstructed how the account was taken over; now establish what was left behind for the containment plan. One detection fired on the mail server against the victim's mailbox after the account was reached. Report the technique name the platform assigned to it.

SOC{...}Hint available

8 tasks · 50 points total

Training Tools

SIEM Console

Log analysis & SPL queries

XDR Console

Endpoint detection & response

Skills You'll Build

Investigate realistic security alerts

SIEM log analysis

XDR log analysis

MITRE ATT&CK® technique identification

Triage decisions: escalate, investigate, or close

Evidence collection and documentation

Job-ready incident response methodology

Intermediate

Requires foundational alert triage skills. Multiple data sources to correlate.

Prerequisites

Basic understanding of security alerts
Familiarity with SIEM concepts
Familiarity with XDR concepts

Ready to investigate?

More Operations

View all

IntermediateSIEMXDR

Cobalt Strike: Beacon Detection

In this scenario, a threat actor has gained a foothold in a corporate environment. You will serve as a SOC Analyst tasked with identifying the initial infection vector, tracing lateral movement, and uncovering the final objectives of the intrusion. This room focuses on detecting beacon traffic, process injection patterns, and the hands-on-keyboard activity that precedes encryption. You will utilize SIEM logs and XDR telemetry to reconstruct the attack timeline and identify critical Indicators of Compromise (IOCs).

1h50 pts

IntermediateSIEMXDR

Kerberoasting: Service Ticket to Domain Admin

In this scenario, you will investigate a high-speed identity-based attack. Starting from an edge device exploitation, an adversary moves laterally to a domain-joined workstation and targets Active Directory. You must analyze SIEM logs for Kerberos ticket anomalies (RC4 encryption), correlate XDR process trees for Impacket usage, and identify the 'malware-free' techniques used to escalate privileges to Domain Admin.

55m50 pts

IntermediateSIEMXDR

Cloud Identity Under Siege

Nine days of telemetry from a cloud-first Azure estate: Entra ID sign-ins, Windows endpoints, a Kubernetes cluster, an Azure Function and the storage accounts behind them all report into one SIEM. Something inside that window does not fit the shape the estate normally has. Work the SIEM, XDR, firewall and cloud panels together, pin each observation to a host and a principal you can name, and rebuild the sequence from the records themselves.

1h50 pts