The Backdoored Browser Extension: Following the C2 Beacon
A routine Chrome auto-update silently trojanized a productivity extension on a finance workstation at Halverson Logistics. The extension beaconed to an attacker C2 domain, harvested the analyst's session cookies and an API token, and exfiltrated them to a VULTR-hosted server. With no malware on disk, the proxy and firewall logs are the only trail. Walk them step by step to trace the beacon, the theft, and the exfiltration.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: an extension that updated itself into a thief
0A finance workstation started making quiet outbound connections to servers nobody recognizes shortly after a browser extension updated itself. Before you dig in, get oriented on how a trojanized extension turns into a data thief.
Find the domain the extension phoned home to
15Right after the extension updated, the workstation reached out to a domain it had never contacted before to pull down a configuration file. Identify that command-and-control domain.
Trace where the stolen cookies were sent
15After the extension read the analyst's session cookies and token, it shipped them out of the network. A POST request carried thousands of bytes to an external server. Identify the IP address that received the stolen data.
Identify the malicious background script
15To confirm the extension build is trojanized, you need the hash of the script that does the phoning-home. Find the SHA256 of the malicious background script that was added in this version.
Find the browser storage key the config was hidden in
10The extension cached its harvesting configuration inside the browser so the content script could read it. For fleet-wide hunting you need the exact storage key. Identify it.
Map the cookie theft to MITRE ATT&CK
10Step back and label the core objective of this attack. The extension's whole purpose was to lift the analyst's logged-in browser session so the attacker could reuse it. Provide the ATT&CK technique ID for that behavior.
6 tasks · 65 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.