Open Bucket, Open Books
A payments vendor's S3 bucket of bank-mandate PDFs was quietly made world-readable. Anonymous outsiders listed and bulk-downloaded the data with no credentials. Work the cloud audit trail to reconstruct the exposure and the theft.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find what was exposed
10Internal bank-mandate documents were downloaded by people who never authenticated. Identify the storage container they came out of.
Trace the first outsider
15Pinpoint the external address that first listed the bucket without credentials.
Attribute the account
15Identify the AWS account that owned the exposed bucket.
Classify the root cause
10Map the exposure to its MITRE ATT&CK technique for cloud-stored data.
4 tasks · 50 points total
Training Tools
Cloud Console
Cloud infrastructure logs
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with Cloud concepts
Ready to investigate?
More Operations
View allMFA Fatigue: The Notification Flood
In this guided walkthrough, you will step into the shoes of a SOC analyst investigating a modern identity-based attack. The threat landscape in 2026 has shifted: adversaries are no longer just 'breaking in'; they are logging in. You will analyze real-time identity signals, correlate disparate log sources across a hybrid cloud environment, and identify the markers of an MFA fatigue attack used by the FlowerStorm phishing kit. This scenario highlights the critical importance of behavioral analysis over simple IOC matching in an era of malware-free intrusions and compromised human identities.
Wide Open
An Elasticsearch node that should have stayed on the internal network had its API exposed to the internet on port 9200 with no authentication. Scanners found it within hours; one actor ran code on the host and dropped a cryptominer, another wiped every index and left a ransom note. Reconstruct the chain from the Linux host logs and the perimeter firewall.
Transfer Denied: The MOVEit Web Shell
An internet-facing MOVEit Transfer server is breached through an unauthenticated SQL injection. A stealthy web shell, gated by a secret header, enumerates and steals stored files and plants a rogue account. Work the web request logs to reconstruct the data theft.