The Gentlemen Ransomware: FortiVPN Login to EDR Kill and Rclone Exfiltration
Late one evening the endpoint sensor on a management server went quiet after a run of administrative-looking activity: a VPN login, a remote session, a new tunnel service, a scan exclusion and a large outbound transfer. Internal IT reaches servers from the VPN pool, runs the same tunnel product elsewhere and keeps a documented exclusion, so at first glance much of this looks routine. Work the FortiGate, Windows, Sysmon, endpoint and firewall evidence and answer each task from what the panels show.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Open the case
0This operation follows one night of The Gentlemen ransomware crew's pre-encryption playbook across the perimeter, the servers and the endpoint sensor. Work the SIEM, XDR and firewall panels to answer the tasks that follow. This is a no-answer briefing checkpoint.
Who the gateway let in
5Begin on the jump server, not at the gateway. Late on 10 September a visitor came in over RDP and was given elevated rights in that same second. Those credentials also made a planned visit that morning from a desk on the LAN; the late visit came from an inside IP of the kind the gateway lends to whoever it admits. Carry that IP to the gateway's own records for the evening, find to whom it was lent, and submit the identity the gateway admitted, which need not match the credentials used on the server.
Where the console came from
5Return to the jump server and pick any program the late visitor started there, for example the console it raised to administrator a few minutes in. Each program start carries the identifier of the sign-in it belongs to. Follow that identifier back to its sign-in record and submit the IP that sign-in arrived from.
What kept the line up
10Soon after the visitor was given elevated rights, the jump machine held one channel to the outside up far longer than anything else it sends. Find that long-lived channel at the perimeter, then the binary on the machine that owns it and the command it runs with. That command carries a secret which also appears in the entry the OS recorded when the binary was set up to launch at boot. Submit the label it was set up under.
Recover the exclusion that was added
10During the session a broad antimalware scan exclusion was added and attributed to the account. Find the configuration-change record and the path that was excluded, and provide that path.
Identify the driver that was loaded
10A script was read from the domain NETLOGON share, a loader and a driver were written into the excluded directory, and the driver loaded shortly before the server's sensor stopped reporting. Provide the file name of the driver that was loaded.
Attribute the outbound transfer
10After the sensor went quiet, a sync client copied a file share out over a few large outbound sessions, the exfiltration stage of The Gentlemen playbook. Working from the destination the server resolved and connected to, provide the external endpoint the data was sent to.
7 tasks · 50 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allPasskey Help-Desk Vishing: Rogue MFA Registration to SharePoint Data Theft
An identity alert fired at 13:53 UTC on 29 September on Tomas Ferreira's account at Northcape Mutual Insurance: a new Microsoft Authenticator method was registered. The service desk is halfway through a company passkey rollout (CHG-2026-0412), three identical alerts were closed as benign earlier in the wave, and Tomas's own note on the ticket says IT called him that afternoon about the rollout, walked him through the enrolment page and that he approved the prompt on his phone. A second alert for a bulk download on the same account landed in the queue that evening, next to one for a Claims colleague that was closed against a change record three hours earlier. You have three weeks of Entra sign-in and directory audit events, the Microsoft 365 activity for SharePoint, OneDrive and Exchange, the estate's Windows and web telemetry and the SOC's own case history. Work the evidence to establish what was added to the account, from where, and what happened next.
MSP360 and ScreenConnect: Phishing Installer to Dual-RMM Persistence
Overnight hunting flagged two signed remote management agents calling home from one advisory associate's workstation, both installed within the same hour yesterday morning, with PowerShell running under one of them. The user says they opened a document review link; IT runs a sanctioned remote-support tool elsewhere, so at first read this looks like a rollout. Work the email, endpoint, SIEM and firewall evidence to establish how the agents arrived and what they were used for.
Cobalt Strike: Beacon Detection
In this scenario, a threat actor has gained a foothold in a corporate environment. You will serve as a SOC Analyst tasked with identifying the initial infection vector, tracing lateral movement, and uncovering the final objectives of the intrusion. This room focuses on detecting beacon traffic, process injection patterns, and the hands-on-keyboard activity that precedes encryption. You will utilize SIEM logs and XDR telemetry to reconstruct the attack timeline and identify critical Indicators of Compromise (IOCs).