Malicious npm Package: Postinstall Infostealer
A developer at a software company runs a routine npm install and the terminal returns clean. Less than a minute later the web proxy records a large outbound upload from that workstation. Work the process tree, the file activity and the outbound traffic to reconstruct what the install actually did.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: what happened on the build workstation
0Your team lead flagged a large outbound upload from Jordan’s workstation during a late-morning build run. Before you start pulling logs, get oriented on how a package install can become an execution event.
Identify the malicious package that triggered the hook
10Start by finding which package actually ran a postinstall script on this host. The proxy recorded the registry downloads for the install session; the file monitor recorded what landed on disk afterwards.
Identify what executed the postinstall script
10npm does not execute a postinstall script itself; it hands it to another program. Use the process tree to name the program that actually ran it. Give the bare file name, with no path.
Find the file the script staged on disk
15The script left one artefact of its own behind while it worked. Identify that file by name.
Pinpoint the exfiltration destination
15The material collected on the host did not stay there. Identify the destination it was sent to, using the proxy and DNS records.
Map the initial access to MITRE ATT&CK
10Close out by classifying how the attacker got code running on this host. Everything you need is in the four steps you have just worked.
6 tasks · 60 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.