OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: an attachment, an alert, and no story yet
0A workstation on the contracts team triggered an endpoint alert this afternoon. Get oriented before you touch the evidence: who was targeted, what the alert saw, and how you are going to work the case.
Trace the delivery to its sender
15Start at the email gateway. Three messages reached Priya's mailbox in the window around the alert. Work out which one carried the delivery, and recover the sender address behind it.
Identify the file Priya opened
15Priya saved the attachment and opened it. Two files were created on her workstation in the minutes that followed. Identify the one she actually received.
Follow the execution chain from the click
15Opening the notebook and clicking its button set off a chain of processes. Read the endpoint process tree and name the first process started by the application that had the attachment open.
Name the loader that was downloaded and disguised
15The chain reached out to the internet and pulled something down. Identify the file that was written to disk on glf-wks-218 and then executed.
Classify the disguise technique
10Step back from the individual indicators and label the behaviour. Two artifacts recovered from this chain are shown below. They come from different stages and they are different kinds of object, but an analyst skimming the evidence would struggle with both for the same reason. Give the MITRE ATT&CK technique ID that covers it.
6 tasks · 70 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with Email concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.
The Backdoored Browser Extension: Following the C2 Beacon
A routine Chrome auto-update silently trojanized a productivity extension on a finance workstation at Halverson Logistics. The extension beaconed to an attacker C2 domain, harvested the analyst's session cookies and an API token, and exfiltrated them to a VULTR-hosted server. With no malware on disk, the proxy and firewall logs are the only trail. Walk them step by step to trace the beacon, the theft, and the exfiltration.