Cobalt Strike and SOCKS: 11 Days to LockBit
An eleven-day, hands-on-keyboard intrusion that began with a phishing message and ended in enterprise-wide LockBit ransomware. The operator hid a Cobalt Strike beacon in a trusted Windows process, ran a pair of SOCKS proxies for pivoting, dumped LSASS and the Active Directory database, and exfiltrated data to a cloud share and FTP drops before encrypting the estate. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find the initial payload
35Every later event traces back to one execution on one workstation. Identify the file the user was tricked into running.
Classify the beacon's hiding technique
30The Cobalt Strike beacon did not run as its own process. Identify the MITRE ATT&CK technique for how it concealed itself.
Separate the pivots from the command channel
35The operator ran more than one outbound tunnel. Identify the external IP of the SystemBC SOCKS proxy used for pivoting.
Recover the harvested administrator
35On the second day the operator dumped credential memory and got a privileged account. Identify the account they recovered and reused.
Classify the domain controller credential theft
30With domain administrator rights the operator went after every credential at once. Classify how they did it on the domain controller.
Trace the cloud exfiltration
35Before encrypting, the operator stole the data. Identify the legitimate cloud service they copied it to.
Recover the encryptor indicator
35Pin down the file-level indicator for the LockBit payload so it can be hunted. Provide the SHA-256 of the encryptor binary.
Classify the encryptor deployment
30The encryptor did not run by hand on every host. Classify how the operator executed it across the estate.
9 tasks · 265 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allSandworm: Trojanized KMS Activator to DcRAT
A staff member at the energy provider Ridna Energo downloaded a free Microsoft KMS activation tool that turned out to be trojanized. Within minutes it dropped the BACKORDER loader, disabled Defender, proxy-loaded the DcRAT implant through rundll32, and opened an encrypted channel to a single anonymizing C2 node. Reconstruct the full espionage intrusion, from the lure download through credential theft, lateral movement, and exfiltration over command-and-control, across endpoint, network, and perimeter telemetry.
Fake IP Scanner to BlackCat Ransomware
A multi-day, hands-on-keyboard intrusion that began with a malvertising lure for a popular network scanning utility and ended in enterprise-wide BlackCat ransomware. The trojanized installer side-loaded a malicious library to stage Sliver and Cobalt Strike, the operator dumped credentials living-off-the-land, moved laterally over SMB, exfiltrated data with a renamed Restic client to a dedicated host, then deleted shadow copies and encrypted the estate. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Storm-0408: Malvertising Drops Lumma via GitHub
An after-hours visit to a pirated sports stream feeds a corporate workstation through a malvertising redirect chain that pulls a dropper from an abused public code-hosting service. A hidden PowerShell loader sets Run-key persistence and fetches the Lumma infostealer and a NetSupport RAT, which run through signed .NET living-off-the-land binaries to dodge application control. Lumma steals the browser credential store and exfiltrates it over HTTPS. Correlate proxy, Windows, XDR, and firewall telemetry to rebuild the chain from the ad redirect to the exfiltration endpoint and hand the team the indicators to contain it.