Open SMB Share: Unauthorized Data Access
A finance file share on an internal Windows server was misconfigured to allow all domain users read access. A workstation account with no finance role connected over SMB and bulk-read payroll records, M&A strategy documents, and board materials. Reconstruct the session from Windows Security audit events and internal firewall logs.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Locate the share connection
10An alert fired on unusual SMB traffic from a workstation to the file server during business hours. Start by establishing which account connected to the file server and which share it accessed.
Identify the accessing account
15Now that the share is known, identify who made the unauthorized connection. The answer is a domain account that has no role in finance or HR.
Trace the workstation source
15Correlate the SIEM event with the firewall to determine which workstation initiated the SMB connection to the file server.
Count the sensitive files accessed
10Event 5145 records each individual file access within a share. Determine how many distinct sensitive files were read by the unauthorized account during the session.
Identify the misconfigured permission
15The root cause of this incident is a share permission that should never have been granted. Identify the overly broad Windows built-in group that was assigned read access to the sensitive share.
Map the collection technique
15Classify the data-gathering activity using the MITRE ATT&CK framework. Identify the technique that describes an adversary reading data from accessible network file shares.
6 tasks · 80 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allExposed MongoDB: Open Database to Ransom Note
A MongoDB instance left reachable from the internet on tcp/27017 with no authentication was found by scanners within hours. One actor read the customer-records data, another bulk-dumped every collection, and a third dropped every database and inserted a ransom note. Reconstruct the full chain from the MongoDB audit logs and the perimeter firewall.
DNS Tunneling: Covert Exfiltration from One Host
A single workstation at Valkara Analytics has been leaking data all day through a DNS tunnel. Every query carries encoded payload chunks inside high-entropy subdomain labels to an attacker-controlled name server. Reconstruct the tunnel from resolver and firewall logs, identify the compromised host and the attacker's infrastructure, and map the technique to ATT&CK.
Scheduled Task Persistence: Recurring Beacon on a Host
A dropper disguised as a license-activation tool runs on a financial-sector workstation and registers a Windows Scheduled Task to re-execute a PowerShell stager every 15 minutes. Each firing beacons over HTTPS to an attacker-controlled domain. Investigate the event log, XDR process tree, and proxy records to trace the persistence chain from dropper to C2.