MFA Fatigue: The Notification Flood
In this guided walkthrough, you will step into the shoes of a SOC analyst investigating a modern identity-based attack. The threat landscape in 2026 has shifted: adversaries are no longer just 'breaking in'; they are logging in. You will analyze real-time identity signals, correlate disparate log sources across a hybrid cloud environment, and identify the markers of an MFA fatigue attack used by the FlowerStorm phishing kit. This scenario highlights the critical importance of behavioral analysis over simple IOC matching in an era of malware-free intrusions and compromised human identities.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
The Phishing Hook
5Start with the identity attack model: AiTM phishing captures credentials, while MFA fatigue tries to turn repeated push prompts into user approval. Review the primer so the authentication events make sense before investigating.
The MFA Fatigue Pattern
10Begin at the authentication layer. Read the XDR authentication timeline for nora.beckett, work out what the sequence of push events actually shows, and submit the MITRE ATT&CK technique ID that names that behavior.
Identifying the Attack Tool
10Move from identity compromise to endpoint activity. In the XDR process tree for corp-wks-042, follow the attacker-controlled parent process to the child that launched lateral-movement tooling.
Lateral Movement Discovery
10Correlate the endpoint process tree with network telemetry. The attacker moved laterally over SMB using pass-the-hash: no password required. Find the exact NTLM hash the wmiexec.py command replayed to authenticate, and submit it.
Mapping the Blast Radius
10Turn the lateral-movement pattern into scope. Compare denied and successful SMB attempts, then identify which workstation actually received an attacker session and staged activity.
Containment and Lessons Learned
5Review the full chain from phishing through MFA fatigue, endpoint foothold, lateral movement, and containment. Confirm the response steps that reduce account and host risk after an MFA fatigue compromise.
6 tasks · 50 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.