Cobalt Strike and SOCKS: 11 Days to LockBit
An eleven-day, hands-on-keyboard intrusion that began with a phishing message and ended in enterprise-wide LockBit ransomware. The operator hid a Cobalt Strike beacon in a trusted Windows process, ran a pair of SOCKS proxies for pivoting, dumped LSASS and the Active Directory database, and exfiltrated data to a cloud share and FTP drops before encrypting the estate. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find the initial payload
35Every later event traces back to one execution on one workstation. Identify the file the user was tricked into running.
Classify the beacon's hiding technique
30The Cobalt Strike beacon did not run as its own process. Identify the MITRE ATT&CK technique for how it concealed itself.
Separate the pivots from the command channel
35The operator ran more than one outbound tunnel. Identify the external IP of the SystemBC SOCKS proxy used for pivoting.
Recover the harvested administrator
35On the second day the operator dumped credential memory and got a privileged account. Identify the account they recovered and reused.
Classify the domain controller credential theft
30With domain administrator rights the operator went after every credential at once. Classify how they did it on the domain controller.
Trace the cloud exfiltration
35Before encrypting, the operator stole the data. Identify the legitimate cloud service they copied it to.
Recover the encryptor indicator
35Pin down the file-level indicator for the LockBit payload so it can be hunted. Provide the SHA-256 of the encryptor binary.
Classify the encryptor deployment
30The encryptor did not run by hand on every host. Classify how the operator executed it across the estate.
9 tasks · 265 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.