OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: an attachment, an alert, and no story yet
0A workstation on the contracts team triggered an endpoint alert this afternoon. Get oriented before you touch the evidence: who was targeted, what the alert saw, and how you are going to work the case.
Trace the delivery to its sender
15Start at the email gateway. Three messages reached Priya's mailbox in the window around the alert. Work out which one carried the delivery, and recover the sender address behind it.
Identify the file Priya opened
15Priya saved the attachment and opened it. Two files were created on her workstation in the minutes that followed. Identify the one she actually received.
Follow the execution chain from the click
15Opening the notebook and clicking its button set off a chain of processes. Read the endpoint process tree and name the first process started by the application that had the attachment open.
Name the loader that was downloaded and disguised
15The chain reached out to the internet and pulled something down. Identify the file that was written to disk on glf-wks-218 and then executed.
Classify the disguise technique
10Step back from the individual indicators and label the behaviour. Two artifacts recovered from this chain are shown below. They come from different stages and they are different kinds of object, but an analyst skimming the evidence would struggle with both for the same reason. Give the MITRE ATT&CK technique ID that covers it.
6 tasks · 70 points total
Training Tools
Email Console
Email header & content analysis
XDR Console
Endpoint detection & response
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with Email concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allExposed .git Folder: Scanning the Web for Secrets
A public web server at Larkspur Logistics was deployed straight from a git checkout, leaving its .git directory exposed to the Internet. Following the EMERALDWHALE playbook, an attacker pulled /.git/config, stole the GitHub token baked into the clone URL, cloned the private repository, and found a hard-coded AWS key inside that handed them the cloud account. Walk the access, GitHub, and CloudTrail logs step by step to trace one misconfiguration into a full credential-theft chain.
Anatsa Banker: The Trojan Hiding in a Google Play PDF Reader
A relationship manager at Larkfield Mutual installs a five-star PDF and QR reader from the Google Play store onto her managed Android handset. It is an Anatsa (TeaBot) dropper: it stages a DEX payload disguised as an app update, sidesteps sandbox checks, downloads the final banking trojan, and abuses the Accessibility service to overlay a fake bank login. Walk the EMM/MDM and web-proxy logs step by step to trace the install, the staged downloads, the C2 callback, and the final payload.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.