Purchase Order, Poisoned
A sales coordinator opened a malspam 'purchase order' and a finance workstation went quiet, then started talking to the internet. Follow the chain from a sender-spoofed email through an Equation Editor exploit, a rundll32 loader, Run-key persistence, and a hollowed system process to the FormBook stealer's HTTP command-and-control.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Trace the delivery
15A finance workstation lit up the endpoint console this morning, and the trail starts in the mailbox. One inbound message carried a weaponized purchase-order attachment that failed sender authentication. Establish who sent it.
Pin the exploited binary
15The attachment did not rely on macros. Opening it kicked off a process that has no legitimate reason to run from a document. Identify the executable whose launch marks the moment of compromise.
Recover the loader
15After the exploit fired, execution was proxied through a trusted system utility that loaded attacker code from the user's profile. Recover the file it loaded.
Find what is wearing a disguise
15To survive inspection, the loader did not run its payload openly, it hid the malware inside a legitimate, signed Windows process. Identify the process it took over.
Cut off the channel
15The disguised process reached out to attacker infrastructure to take orders and ship stolen data. To contain the host and block the channel, identify the command-and-control host it contacted.
Classify the persistence
15For the report, classify how the malware ensured it would run again after reboot. Map that persistence mechanism to its MITRE ATT&CK technique.
6 tasks · 90 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with Email concepts
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.