Fighting Ursa: Car-for-Sale Lure to HeadLace
A diplomatic attache clicked a link offering a discounted vehicle for sale, and a trusted Windows program started behaving like malware. Follow the chain from a spearphishing link through an abused web-service redirector and a staged archive to a side-loaded HeadLace loader running under a legitimate signed binary.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Read the case file
0A diplomatic workstation raised an endpoint alert this morning. Before pivoting through the data, understand what you are looking at.
Find the way in
15The intrusion began in the mailbox. One inbound message used a sales pitch to get the attache to click. Recover where that click sent the browser.
Recover the payload archive
15The link did not drop malware directly. After showing a convincing decoy, it handed the browser a file. Identify the archive that landed on the workstation.
Spot the trusted decoy
15The archive did not contain obvious malware. It bundled a perfectly legitimate Windows program whose only job was to be run by the victim. Name the signed binary that was used as the launch vehicle.
Unmask the loader
15Running the trusted program caused it to pull in attacker code from its own folder instead of the real Windows library. Recover the malicious module it loaded.
Confirm the technique
15For the incident report, classify the core evasion technique: a trusted signed program was made to load an attacker library placed beside it. Map it to its MITRE ATT&CK technique.
6 tasks · 75 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with XDR concepts
- Familiarity with Email concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.