Daemon in the Dark
A Linux Docker host quietly started mining crypto overnight. Its container-engine API was open to the internet, and an automated intruder used it to launch a host-mounting container, drop the Kinsing malware and an XMRig miner, kill the defenses, and try to spread. Work the host, perimeter, and cloud trails to reconstruct the intrusion.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the way in
15A Linux container host started mining cryptocurrency overnight with no human logged in. Before anything was dropped, something on the perimeter let an outsider talk directly to the container engine. Determine which TCP port the host was managing the engine over that an external address reached.
Trace the supply drop
20Once inside, the intruder ran a container that mounted the host and pulled its toolkit down with a shell one-liner. Identify the external address the first-stage script and the malware were fetched from.
Name the implant
15A persistent Golang agent was installed that beacons out and keeps the host enrolled. Identify the on-disk name of that agent binary.
Follow the money
20The second binary is what GuardDuty caught: a miner pinning the CPU. Identify the external address it opened its mining session to.
Classify the objective
10Summarize the attacker's end goal for the report by mapping it to its MITRE ATT&CK technique.
5 tasks · 80 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
- Familiarity with Cloud concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.