From OneNote to RansomNote: A .one Attachment to Nokoyawa Ransomware
A phishing email carrying a malicious OneNote (.one) attachment delivered the IcedID loader, which beaconed quietly for weeks before the operator launched Cobalt Strike, enumerated Active Directory with AdFind, installed AnyDesk for redundancy, moved laterally over RDP, exfiltrated data over SFTP, and deployed Nokoyawa ransomware on the backup and file servers. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find the initial lure
35Everything traces back to one file a user opened. Recover the file-level indicator for the attachment that started the intrusion.
Classify the file-type deception
30The loader was hidden in plain sight by lying about what kind of file it was. Identify the MITRE ATT&CK sub-technique.
Classify the loader's persistence
30The loader made sure it would survive a reboot. Identify the MITRE ATT&CK sub-technique for how it persisted.
Separate hands-on control from the loader
35After weeks of quiet, the operator switched to a second command channel for interactive control. Identify its external IP.
Trace the lateral movement
35The operator reached a server they should never have touched from a workstation. Identify the host they pivoted into first.
Separate the exfiltration from the command channels
35Before encryption the operator stole data on its own infrastructure. Identify the external IP that received it.
Recover the encryptor indicator
35Pin down the file-level indicator for the ransomware so it can be hunted. Provide the SHA-256 of the encryptor binary.
8 tasks · 235 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allPublic by Default: Sensitive Files Pulled From an Open Azure Blob Container
A sensitive-data exposure caused entirely by a storage misconfiguration. A developer set a production Azure Blob container's public access level to anonymous, an external actor swept the *.blob.core.windows.net namespace and found it, listed it with an unauthenticated List Blobs call, then bulk-downloaded the exports — including a config file with a SQL connection string and a nightly database backup — with AzCopy over anonymous HTTPS. Reconstruct the exposure from Azure Storage diagnostic logs and SIEM corroboration, classifying the discovery and collection techniques, in a case where nothing failed and no credential was ever used.
Lingering in the Background: BITS Job Used for Download and Persistence
A teller workstation was cleaned by antivirus, yet the operator's foothold survived. The malware had abused the Background Intelligent Transfer Service: a self-contained BITS job with a SetNotifyCmdLine notification command re-downloads a payload and re-launches it with regsvr32 every time a transfer completes, then deletes its tracks, leaving only the job entry inside the service state database. Reconstruct the persistence loop from BITS-Client operational events, Sysmon process lineage, and endpoint XDR telemetry, prove it outlived the file-based cleanup, and classify the key ATT&CK techniques.
Staged and Gone: Rclone Bulk Upload to MEGA From a File Server
A pre-ransomware bulk data-exfiltration investigation. After a perimeter foothold and hands-on command and control, the operator pivoted to a Windows file share server, recovered a domain-administrator password from a plaintext file, staged finance data into a single archive, and bulk-uploaded it to a MEGA cloud remote with a renamed rclone client over HTTPS before any encryptor ran. The organization also runs rclone legitimately on its backup server, so the challenge is separating the sanctioned job from the theft. Reconstruct the staging-then-upload chain from SIEM and perimeter firewall telemetry.