GootLoader: SEO Poisoning to Domain Control
A paralegal searching for a contract template clicked a poisoned search result and a quiet endpoint script alert turned into a domain controller compromise by nightfall. Follow the chain from a drive-by ZIP through an obfuscated JavaScript loader, scheduled-task and Run-key persistence, a Cobalt Strike beacon, and a SystemBC proxy to the domain controller.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Scope the intrusion
0The endpoint platform raised a scripting-execution alert on a legal-team workstation this morning, and the identity team has separately flagged an out-of-hours administrator logon to the domain controller. Before extracting indicators, orient yourself to the case so the pivots that follow make sense.
Find the poisoned download source
20The user did not receive a malicious email. They searched for a business document, clicked a high-ranking result, and downloaded an archive from a site that should never have served one. Identify the site the archive was downloaded from.
Trace the script execution
20The archive did not contain the document it claimed to. When the user opened its contents, a native Windows interpreter ran a script from the Downloads folder. Name the process that executed the script.
Recover the beacon channel
25After the loader established itself, a system utility loaded attacker code from the user profile and began beaconing to the internet over encrypted web traffic. Recover the command-and-control host it called home to.
Expose the relay channel
20To blend the operator's interactive tooling, a second channel was opened from the workstation to a non-standard port that has no business being open from a finance endpoint. Identify the external address the relay connected to.
Identify the domain-control logon
20Late in the day the intrusion reached its objective: an interactive session into the domain controller using a privileged account. Determine which account was used to log on to the domain controller.
Classify the persistence
15For the report, classify how the loader ensured it would run again after logoff and reboot. The loader used two autostart mechanisms; map the registry-based one to its MITRE ATT&CK technique.
7 tasks · 120 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allEmotet Revival: Triage the November Loader
An operations coordinator opened a thread-hijacked remittance spreadsheet and enabled its macro. A trusted Windows utility quietly fetched a loader from a compromised website, and the workstation started beaconing to addresses nobody recognized. Trace the rebuilt November Emotet loader from a hijacked mail thread through a regsvr32 download-and-register, an encrypted epoch command-and-control pool, and a Cobalt Strike second stage.
IcedID Botnet to Dagon Locker Ransomware
A banking-trojan infection that smouldered for twenty-nine days before erupting into domain-wide Dagon Locker ransomware. A fake document portal served a JScript dropper that installed IcedID; weeks later the operator handed off to a Cobalt Strike beacon over a separate channel, pushed it across the estate through a Group Policy scheduled task, ran AdFind discovery, dumped domain credentials by replicating the directory (DCSync), moved over SMB administrative shares, exfiltrated to AWS S3 with Rclone, and deployed the encryptor while deleting shadow copies. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Vidar: Fake Notepad++ Malvertising to Data Theft
A developer searched for a popular code editor, clicked a paid search ad, and ran an installer that was not the real thing. Follow the chain from a typosquatted landing page through a dynamic-DNS payload host to the Vidar stealer's dead-drop C2 resolution, then pin down the single hosting address that carried both the stolen data and the malware's orders.