Skip to main content
Transfer Denied: The MOVEit Web Shell operation cover
BeginnerSIEMFirewall

Transfer Denied: The MOVEit Web Shell

An internet-facing MOVEit Transfer server is breached through an unauthenticated SQL injection. A stealthy web shell, gated by a secret header, enumerates and steals stored files and plants a rogue account. Work the web request logs to reconstruct the data theft.

30m
6 tasks
25 points
Free

Start this operation

Investigation Tasks

Complete each task by investigating alerts and submitting your findings.

1

Find the foothold

15

Before any file moved, someone reached the MOVEit Transfer app without an account. Identify the external address behind the unauthenticated injection against the public app.

SOC{a.b.c.d}Hint available
2

Name the implant

15

The exploitation wrote something to disk that the attacker came back to. Identify the file the attacker planted in the MOVEit web root.

SOC{filename.ext}Hint available
3

Recover the implant's secret

20

The planted page ignores anyone who does not present a specific custom HTTP header. Identify the request header it uses as a password.

SOC{Header-Name}Hint available
4

Catch the backdoor account

15

The operator gave themselves a durable way back in through the application itself. Identify the rogue MOVEit account that was created and later removed.

SOC{Account Name}Hint available
5

Trace the theft

20

Files left the building. Identify the external address that bulk-downloaded stored files through the web shell.

SOC{a.b.c.d}Hint available
6

Classify the access

10

Map the initial breach to its MITRE ATT&CK technique.

SOC{Txxxx}Hint available

6 tasks · 95 points total

Training Tools

SIEM Console

Log analysis & SPL queries

Firewall Console

Network traffic analysis

Skills You'll Build

Investigate realistic security alerts
SIEM log analysis
Firewall log analysis
MITRE ATT&CK® technique identification
Triage decisions: escalate, investigate, or close
Evidence collection and documentation
Job-ready incident response methodology
Beginner

Ideal for newcomers to SOC operations. Guided investigation with clear indicators.

Prerequisites

  • No prior experience required
  • Familiarity with SIEM concepts
  • Familiarity with Firewall concepts

Ready to investigate?

More Operations

View all
BeginnerSIEMFirewall

Kernel Thread Impostor

An internet-exposed Linux node falls to an SSH password brute force, and within seconds the Outlaw (Dota3) toolkit drops a hidden cryptominer disguised as a kernel thread. Work the auth logs, process records, and perimeter traffic to reconstruct the break-in, the persistence, and the mining.

25m25 pts
BeginnerEmailXDR

Purchase Order, Poisoned

A sales coordinator opened a malspam 'purchase order' and a finance workstation went quiet, then started talking to the internet. Follow the chain from a sender-spoofed email through an Equation Editor exploit, a rundll32 loader, Run-key persistence, and a hollowed system process to the FormBook stealer's HTTP command-and-control.

30m25 pts
BeginnerSIEMFirewall

Daemon in the Dark

A Linux Docker host quietly started mining crypto overnight. Its container-engine API was open to the internet, and an automated intruder used it to launch a host-mounting container, drop the Kinsing malware and an XMRig miner, kill the defenses, and try to spread. Work the host, perimeter, and cloud trails to reconstruct the intrusion.

30m25 pts