Wide Open
An Elasticsearch node that should have stayed on the internal network had its API exposed to the internet on port 9200 with no authentication. Scanners found it within hours; one actor ran code on the host and dropped a cryptominer, another wiped every index and left a ransom note. Reconstruct the chain from the Linux host logs and the perimeter firewall.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the way in
10A production Linux host that hosts an internal datastore started behaving strangely overnight: it reached out to the internet on its own and its data is now gone. Before anything else, establish how the outside world was able to touch it at all.
Trace the hands-on operator
15Automated scanners poke at everything; only some of that traffic is a human looking around. Separate the first interactive enumeration of the cluster from the background noise and attribute it to its source.
Pin down the code execution
20Reading data is one thing; running commands on the box is another. One request crossed that line. Find the external address that turned a query into code execution on the host.
Identify what got planted
15The intrusion did not stop at snooping. Code execution was used to pull something onto the host and run it. Name the file that was planted and left running.
Follow the money out
15The planted process immediately phoned home to monetize the host. Determine where it was sending its work.
Classify the final act
15Hours after the mining began, a separate burst of activity destroyed the cluster's data outright and left a demand behind. Map that destructive action to its MITRE ATT&CK technique.
6 tasks · 90 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allOpen Bucket, Open Books
A payments vendor's S3 bucket of bank-mandate PDFs was quietly made world-readable. Anonymous outsiders listed and bulk-downloaded the data with no credentials. Work the cloud audit trail to reconstruct the exposure and the theft.
Transfer Denied: The MOVEit Web Shell
An internet-facing MOVEit Transfer server is breached through an unauthenticated SQL injection. A stealthy web shell, gated by a secret header, enumerates and steals stored files and plants a rogue account. Work the web request logs to reconstruct the data theft.
Purchase Order, Poisoned
A sales coordinator opened a malspam 'purchase order' and a finance workstation went quiet, then started talking to the internet. Follow the chain from a sender-spoofed email through an Equation Editor exploit, a rundll32 loader, Run-key persistence, and a hollowed system process to the FormBook stealer's HTTP command-and-control.