Trusted Domain, Untrusted Destination: Open-Redirect Phishing
A finance clerk at Larkfield Mutual Assurance clicks a Release My Messages link in an Undelivered Mails phishing email. The link opens with a trusted brand domain that carries an open-redirect flaw, so it sails past URL filtering. Follow the 302 redirect through an attacker cushion server and a JavaScript hop to a spoofed Microsoft 365 login page, then catch the harvested credentials being replayed against the real tenant. Walk the mail gateway, web proxy, and sign-in logs step by step.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: how a safe-looking link ends somewhere else
0A finance clerk reported a strange Undelivered Mails email this afternoon, and minutes later her account signed in from somewhere it should not have. Before you trace it, get oriented on the trick that made the link look safe.
Spot the trusted domain in the phishing link
15The whole attack worked because the link in the email opened with a reputable brand the filter trusted. Read the delivered message and identify which well-known domain the attacker hid behind.
Follow the click off the trusted domain
15When the clerk clicked, the trusted domain did not serve a page. It bounced the browser somewhere else. Use the proxy log to find the intermediate server the redirect actually pointed at.
Find the page that stole the credentials
15The cushion server did not stop there. A JavaScript hop carried the browser to the page that actually imitated the Microsoft sign-in. Identify the domain of that final credential-harvest page.
Catch the credential replay
15Stealing a password is only useful if the attacker uses it. About twenty minutes after the clerk submitted her credentials, her account signed in to the real tenant from somewhere new. Identify the IP address behind that sign-in.
Map this phish to MITRE ATT&CK
10Step back from the indicators and name what made this credible: to the filter that passed the link, and to the clerk who trusted it. Nothing on the endpoint was exploited and no software flaw was involved on your side of the chain. Use the recap below and provide the ATT&CK technique identifier for the behaviour it captures.
6 tasks · 70 points total
Training Tools
Email Console
Email header & content analysis
SIEM Console
Log analysis & SPL queries
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with Email concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allWeaponized SVG: Embedded Code in an Image Attachment
A treasury analyst at a bank opens what looks like a SWIFT payment confirmation, clicks the button inside it, and no document ever appears. Minutes later her workstation is running code out of her own user profile and holding an encrypted session to a host it has never contacted before. Walk the mail gateway, the file artifacts and the endpoint process tree step by step, from the delivery that started it to the beacon that followed.
The Backdoored Browser Extension: Following the C2 Beacon
A routine Chrome auto-update silently trojanized a productivity extension on a finance workstation at Halverson Logistics. The extension beaconed to an attacker C2 domain, harvested the analyst's session cookies and an API token, and exfiltrated them to a VULTR-hosted server. With no malware on disk, the proxy and firewall logs are the only trail. Walk them step by step to trace the beacon, the theft, and the exfiltration.
ClickFix: The Fake CAPTCHA Trap
The ClickFix social engineering technique uses dialogue boxes containing fake error messages to trick victims into copying, pasting, and running malicious content. In this scenario, a user was targeted with a 'Verify You Are Human' CAPTCHA check that led to a significant endpoint compromise. You will analyze the 'paste-and-run' execution chain, investigate PowerShell activity initiated via the Windows Run dialog, and identify the deployment of an information stealer.