Exposed MongoDB: Open Database to Ransom Note
A MongoDB instance left reachable from the internet on tcp/27017 with no authentication was found by scanners within hours. One actor read the customer-records data, another bulk-dumped every collection, and a third dropped every database and inserted a ransom note. Reconstruct the full chain from the MongoDB audit logs and the perimeter firewall.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Establish the exposure
10A financial-services database host started receiving unsolicited connections from the public internet and its data is now gone. Before tracing who did what, determine how external clients were able to reach it at all.
Identify the first hands-on operator
15A census scanner touching the port is just a probe; a client that actually reads data is a deliberate operator. Identify the external address behind the first interactive reconnaissance of the database contents.
Measure the data exposure
15A later connection is not just browsing; it reads every document in every collection. Determine how many bytes of database content left the host during that bulk-read session.
Attribute the destruction
15A separate actor dropped every database and inserted a ransom note. Identify the external IP that performed the destructive phase.
Name the ransom collection
15The attacker left a single document behind to make the victim aware of the demand. Identify the MongoDB collection name that was created to hold the ransom note.
Map the impact to ATT&CK
15The attacker permanently destroyed all database collections and issued a payment demand. Identify the MITRE ATT&CK technique that best describes this deliberate data destruction.
6 tasks · 85 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allRDP Brute Force: Internet-Facing Server Login
An internet-exposed Windows Server running RDP has been receiving a sustained brute-force campaign from an external address. After dozens of failed authentication events, one attempt succeeds and an interactive session is opened. Reconstruct the attack from the Windows Security event log, identify the source and target, and classify the technique.
Open SMB Share: Unauthorized Data Access
A finance file share on an internal Windows server was misconfigured to allow all domain users read access. A workstation account with no finance role connected over SMB and bulk-read payroll records, M&A strategy documents, and board materials. Reconstruct the session from Windows Security audit events and internal firewall logs.
DNS Tunneling: Covert Exfiltration from One Host
A single workstation at Valkara Analytics has been leaking data all day through a DNS tunnel. Every query carries encoded payload chunks inside high-entropy subdomain labels to an attacker-controlled name server. Reconstruct the tunnel from resolver and firewall logs, identify the compromised host and the attacker's infrastructure, and map the technique to ATT&CK.