Daemon in the Dark
A Linux Docker host quietly started mining crypto overnight. Its container-engine API was open to the internet, and an automated intruder used it to launch a host-mounting container, drop the Kinsing malware and an XMRig miner, kill the defenses, and try to spread. Work the host, perimeter, and cloud trails to reconstruct the intrusion.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the way in
15A Linux container host started mining cryptocurrency overnight with no human logged in. Before anything was dropped, something on the perimeter let an outsider talk directly to the container engine. Determine which TCP port the host was managing the engine over that an external address reached.
Trace the supply drop
20Once inside, the intruder ran a container that mounted the host and pulled its toolkit down with a shell one-liner. Identify the external address the first-stage script and the malware were fetched from.
Name the implant
15A persistent Golang agent was installed that beacons out and keeps the host enrolled. Identify the on-disk name of that agent binary.
Follow the money
20The second binary is what GuardDuty caught: a miner pinning the CPU. Identify the external address it opened its mining session to.
Classify the objective
10Summarize the attacker's end goal for the report by mapping it to its MITRE ATT&CK technique.
5 tasks · 80 points total
Training Tools
SIEM Console
Log analysis & SPL queries
Firewall Console
Network traffic analysis
Cloud Console
Cloud infrastructure logs
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
- Familiarity with Cloud concepts
Ready to investigate?
More Operations
View allPurchase Order, Poisoned
A sales coordinator opened a malspam 'purchase order' and a finance workstation went quiet, then started talking to the internet. Follow the chain from a sender-spoofed email through an Equation Editor exploit, a rundll32 loader, Run-key persistence, and a hollowed system process to the FormBook stealer's HTTP command-and-control.
Tomcat Manager Abuse: Weak Credentials to Webshell
An Apache Tomcat server at a retail company has its Manager web application exposed with default credentials. An attacker authenticates, deploys a malicious WAR webshell, runs OS commands through it, and drops a cryptocurrency miner. Walk the Tomcat access logs from the first 401 to the mining pool connection.
WordPress Plugin RCE: Webshell on a Vulnerable Site
A media company's WordPress server is compromised after an attacker exploits an unpatched file-upload plugin to drop a PHP webshell into the public uploads directory. Work through the Apache access logs and IDS alerts step by step, tracing the probe, the upload bypass, and the command execution that followed.