MFA Fatigue: The Notification Flood
In this guided walkthrough, you will step into the shoes of a SOC analyst investigating a modern identity-based attack. The threat landscape in 2026 has shifted: adversaries are no longer just 'breaking in'; they are logging in. You will analyze real-time identity signals, correlate disparate log sources across a hybrid cloud environment, and identify the markers of an MFA fatigue attack used by the FlowerStorm phishing kit. This scenario highlights the critical importance of behavioral analysis over simple IOC matching in an era of malware-free intrusions and compromised human identities.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
The Phishing Hook
5Start with the identity attack model: AiTM phishing captures credentials, while MFA fatigue tries to turn repeated push prompts into user approval. Review the primer so the authentication events make sense before investigating.
The MFA Fatigue Pattern
10Begin at the authentication layer. Read the XDR authentication timeline for nora.beckett, work out what the sequence of push events actually shows, and submit the MITRE ATT&CK technique ID that names that behavior.
Identifying the Attack Tool
10Move from identity compromise to endpoint activity. In the XDR process tree for corp-wks-042, follow the attacker-controlled parent process to the child that launched lateral-movement tooling.
Lateral Movement Discovery
10Correlate the endpoint process tree with network telemetry. The attacker moved laterally over SMB using pass-the-hash: no password required. Find the exact NTLM hash the wmiexec.py command replayed to authenticate, and submit it.
Mapping the Blast Radius
10Turn the lateral-movement pattern into scope. Compare denied and successful SMB attempts, then identify which workstation actually received an attacker session and staged activity.
Containment and Lessons Learned
5Review the full chain from phishing through MFA fatigue, endpoint foothold, lateral movement, and containment. Confirm the response steps that reduce account and host risk after an MFA fatigue compromise.
6 tasks · 50 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allQR Code Phishing: Scan to Compromise
In this scenario, you will investigate a modern 'Quishing' (QR phishing) attack that bypassed traditional email filters by hiding its payload inside an image. You will trace the full chain: a spoofed MFA-enrollment lure sent from purpose-built infrastructure, a redirect server that conceals the final destination, and an Evilginx-style adversary-in-the-middle page that stole an authenticated session cookie despite MFA. You will then follow the attacker's post-compromise moves (Graph API mailbox enumeration, SharePoint exfiltration, and a hidden inbox forwarding rule) and choose the containment action that actually evicts them.
Open Bucket, Open Books
A payments vendor's S3 bucket of bank-mandate PDFs was quietly made world-readable. Anonymous outsiders listed and bulk-downloaded the data with no credentials. Work the cloud audit trail to reconstruct the exposure and the theft.
Wide Open
An Elasticsearch node that should have stayed on the internal network had its API exposed to the internet on port 9200 with no authentication. Scanners found it within hours; one actor ran code on the host and dropped a cryptominer, another wiped every index and left a ransom note. Reconstruct the chain from the Linux host logs and the perimeter firewall.