The Backdoored Browser Extension: Following the C2 Beacon
A routine Chrome auto-update silently trojanized a productivity extension on a finance workstation at Halverson Logistics. The extension beaconed to an attacker C2 domain, harvested the analyst's session cookies and an API token, and exfiltrated them to a VULTR-hosted server. With no malware on disk, the proxy and firewall logs are the only trail. Walk them step by step to trace the beacon, the theft, and the exfiltration.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: an extension that updated itself into a thief
0A finance workstation started making quiet outbound connections to servers nobody recognizes shortly after a browser extension updated itself. Before you dig in, get oriented on how a trojanized extension turns into a data thief.
Find the domain the extension phoned home to
15Right after the extension updated, the workstation reached out to a domain it had never contacted before to pull down a configuration file. Identify that command-and-control domain.
Trace where the stolen cookies were sent
15After the extension read the analyst's session cookies and token, it shipped them out of the network. A POST request carried thousands of bytes to an external server. Identify the IP address that received the stolen data.
Identify the malicious background script
15To confirm the extension build is trojanized, you need the hash of the script that does the phoning-home. Find the SHA256 of the malicious background script that was added in this version.
Find the browser storage key the config was hidden in
10The extension cached its harvesting configuration inside the browser so the content script could read it. For fleet-wide hunting you need the exact storage key. Identify it.
Map the cookie theft to MITRE ATT&CK
10Step back and label the core objective of this attack. The extension's whole purpose was to lift the analyst's logged-in browser session so the attacker could reuse it. Provide the ATT&CK technique ID for that behavior.
6 tasks · 65 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allTrusted Domain, Untrusted Destination: Open-Redirect Phishing
A finance clerk at Larkfield Mutual Assurance clicks a Release My Messages link in an Undelivered Mails phishing email. The link opens with a trusted brand domain that carries an open-redirect flaw, so it sails past URL filtering. Follow the 302 redirect through an attacker cushion server and a JavaScript hop to a spoofed Microsoft 365 login page, then catch the harvested credentials being replayed against the real tenant. Walk the mail gateway, web proxy, and sign-in logs step by step.
ClickFix: The Fake CAPTCHA Trap
The ClickFix social engineering technique uses dialogue boxes containing fake error messages to trick victims into copying, pasting, and running malicious content. In this scenario, a user was targeted with a 'Verify You Are Human' CAPTCHA check that led to a significant endpoint compromise. You will analyze the 'paste-and-run' execution chain, investigate PowerShell activity initiated via the Windows Run dialog, and identify the deployment of an information stealer.
Credential Harvesting: The Lookalike Login
Investigate an adversary-in-the-middle (AiTM) credential phishing campaign that lured an employee to a lookalike Microsoft 365 login page. Working entirely from SIEM logs, you will identify the lookalike domain, reconstruct the multi-hop redirect chain through a compromised legitimate site, uncover a secondary phishing wave against another employee, and confirm account takeover in Azure AD sign-in logs via impossible travel and session-token replay. You finish by choosing the containment action that actually evicts an attacker holding a valid session token. Foundational skills for SOC analysts in lookalike-domain analysis and identity-centric incident response.