MSP360 and ScreenConnect: Phishing Installer to Dual-RMM Persistence
Overnight hunting flagged two signed remote management agents calling home from one advisory associate's workstation, both installed within the same hour yesterday morning, with PowerShell running under one of them. The user says they opened a document review link; IT runs a sanctioned remote-support tool elsewhere, so at first read this looks like a rollout. Work the email, endpoint, SIEM and firewall evidence to establish how the agents arrived and what they were used for.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Open the case
0Orient yourself on the MSP360 and ScreenConnect agents that appeared on one workstation before pivoting into the email, SIEM, XDR and firewall panels. This is a no-answer briefing checkpoint.
Trace the delivery
10Every later event on the workstation traces back to one message in the email panel. Identify how the file the user ran reached them, as a MITRE ATT&CK sub-technique.
Fingerprint what asked for elevation
10In the XDR panel, pin down the SHA-256 of what asked for administrative rights on the desk, so it can be swept across the estate.
Classify the persistence
10What the user ran did not just execute once: it made sure the MSP360 agent would start again after a reboot. Classify how, as a MITRE ATT&CK sub-technique.
Find the second channel's relay
10The MSP360 agent you traced brought a second remote-support client, ScreenConnect, onto the desk. Identify the external host that second client connects to.
Recover the inbound rule it opened
10In the same minute the MSP360 agent was set up, the workstation was also opened to inbound connections for it. Identify the inbound port that was allowed.
6 tasks · 50 points total
Training Tools
Email Console
Email header & content analysis
XDR Console
Endpoint detection & response
SIEM Console
Log analysis & SPL queries
Firewall Console
Network traffic analysis
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Email concepts
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Gentlemen Ransomware: FortiVPN Login to EDR Kill and Rclone Exfiltration
Late one evening the endpoint sensor on a management server went quiet after a run of administrative-looking activity: a VPN login, a remote session, a new tunnel service, a scan exclusion and a large outbound transfer. Internal IT reaches servers from the VPN pool, runs the same tunnel product elsewhere and keeps a documented exclusion, so at first glance much of this looks routine. Work the FortiGate, Windows, Sysmon, endpoint and firewall evidence and answer each task from what the panels show.
Cobalt Strike: Beacon Detection
In this scenario, a threat actor has gained a foothold in a corporate environment. You will serve as a SOC Analyst tasked with identifying the initial infection vector, tracing lateral movement, and uncovering the final objectives of the intrusion. This room focuses on detecting beacon traffic, process injection patterns, and the hands-on-keyboard activity that precedes encryption. You will utilize SIEM logs and XDR telemetry to reconstruct the attack timeline and identify critical Indicators of Compromise (IOCs).
Finance Mailbox Takeover at MegaCorp Logistics
A finance analyst at MegaCorp Logistics reported that colleagues were receiving replies to messages she never sent, and her account was disabled while the investigation runs. You have the SIEM feed and the endpoint XDR telemetry for the workstation estate and the mail platform, covering the week around the report. Reconstruct what happened: which host produced the endpoint evidence, what its browser reached, how the account was taken over, and what was left behind on the mail platform so the containment plan is complete.