OneClik: ClickOnce + AppDomainManager Injection with ETW Patching and AWS-Hidden C2
A ClickOnce-delivered intrusion at an oil-and-gas operator that mirrors nation-state tradecraft. A spearphishing link served a Microsoft ClickOnce deployment that ran under the trusted dfsvc.exe, sideloaded a signed binary whose tampered .config used .NET AppDomainManager hijacking to load an attacker assembly at CLR startup, patched Event Tracing for Windows to blind the sensor, ran anti-debugging checks, and injected a Golang backdoor (RunnerBeacon) that hid its C2 behind AWS CloudFront and API Gateway. Reconstruct the chain from email, endpoint XDR, and cloud audit telemetry, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Classify the proxied-execution technique
30The loader never ran from an obviously malicious process. Identify the MITRE ATT&CK sub-technique for how the deployment first executed under a trusted Microsoft host.
Name the sideloaded signed binary
30Attacker code first ran under a legitimate, signed program. Identify the signed binary that was abused to load it.
Classify the runtime injection technique
35The signed binary was made to load attacker code through a .NET runtime feature, not a code-injection API. Classify the technique.
Recover the loader assembly hash
35Pin down the file-level indicator for the attacker assembly the runtime loaded. Provide its SHA-256.
Classify the telemetry-blinding technique
30Just before the backdoor was injected, the loader blinded the endpoint sensor. Classify what it did.
Identify the cloud-fronted command channel
35The backdoor hid its command and control inside trusted cloud services. Identify the CloudFront distribution it beaconed to.
Recover the paired C2 task endpoint
35The command channel had a second AWS surface for fetching tasks. Identify the API Gateway endpoint paired with the distribution.
8 tasks · 230 points total
Training Tools
Email Console
Email header & content analysis
XDR Console
Endpoint detection & response
Cloud Console
Cloud infrastructure logs
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with Email concepts
- Familiarity with XDR concepts
- Familiarity with Cloud concepts
Ready to investigate?
More Operations
View allMidnight Blizzard: Malicious Entra App Registration and Service Principal Abuse
A nation-state-style identity-plane intrusion that lives entirely in Microsoft Entra ID and Exchange Online. A low-and-slow password spray across rotating residential-proxy IPs lands on a legacy, no-MFA test account; from there the actor pivots into the application layer, creates a rogue user, registers a new malicious application and service principal, grants it the Office 365 Exchange Online full_access_as_app role plus EWS.AccessAsUser.All, adds a client secret for durable app-only access, and reads corporate mailboxes over Exchange Web Services with no user sign-in. Work the Entra sign-in audit, the application and service-principal lifecycle and role-assignment events, the credential change, and the EWS mailbox operations to reconstruct the chain and classify the key ATT&CK techniques.
Org2Org: Scattered Spider's Okta Impersonation
A help-desk social-engineering intrusion that abused Okta's inbound federation (Org2Org) to impersonate users across tenants. An operator phoned the IT service desk to reset a Super Administrator's MFA factors, re-enrolled the factor from an anonymizing proxy, and signed in to the Okta Admin Console as Super Admin. They granted Super Administrator to a second account for persistence, then stood up a second, attacker-controlled Identity Provider as an inbound-federation source and manipulated its username parameter to log in as real users with no victim password or MFA. Work the SIEM service-desk trail and the Okta System Log to reconstruct the chain and classify the trusted-relationship abuse.
FortiJump: FortiManager Zero-Day Config Heist
A FortiManager appliance is breached through an FGFM authentication bypass (the FortiJump zero-day): an attacker-controlled FortiManager registers itself as a trusted device, stages every managed FortiGate's configuration into a single hidden archive on the appliance, and exfiltrates it over HTTPS, stealing the fleet inventory and FortiOS256-hashed administrator passwords. Weeks later the operator re-registers and exfiltrates again to fresh infrastructure. With no malware on any firewall and no endpoint to inspect, reconstruct the entire heist from the appliance event log and perimeter firewall alone.