QR Code Phishing: Scan to Compromise
In this scenario, you will investigate a modern 'Quishing' (QR phishing) attack that bypassed traditional email filters by hiding its payload inside an image. You will trace the full chain: a spoofed MFA-enrollment lure sent from purpose-built infrastructure, a redirect server that conceals the final destination, and an Evilginx-style adversary-in-the-middle page that stole an authenticated session cookie despite MFA. You will then follow the attacker's post-compromise moves (Graph API mailbox enumeration, SharePoint exfiltration, and a hidden inbox forwarding rule) and choose the containment action that actually evicts them.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
QR Code Phishing
5Start with why quishing works: the email body contains an image rather than a clickable URL, so security controls must decode and inspect the QR payload. Read the setup before following the logs.
The Redirect Server
10Analyze the SIEM and email gateway logs to identify the first redirect server in the phishing chain: the IP address that the decoded QR code URL initially resolves to.
The Credential Harvesting Server
10Trace the victim after the redirect. Review the captured web and identity events to find where the fake Microsoft login page received the credential submission.
Infrastructure Mapping
10Separate phishing delivery infrastructure from post-compromise operations. After the session theft, use sign-in telemetry to identify the server the attacker used to access Microsoft services as Sarah.
The Phishing Domain
10Do not trust the display sender. Inspect headers and supporting gateway telemetry to identify the phishing management domain behind the QR-code campaign infrastructure.
Containment
5Finish with containment for session-cookie theft and mailbox abuse. Review the confirmed server chain, stolen-session activity, and inbox-rule persistence before choosing the action that ends access.
6 tasks · 50 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allCredential Harvesting: The Lookalike Login
Investigate an adversary-in-the-middle (AiTM) credential phishing campaign that lured an employee to a lookalike Microsoft 365 login page. Working entirely from SIEM logs, you will identify the lookalike domain, reconstruct the multi-hop redirect chain through a compromised legitimate site, uncover a secondary phishing wave against another employee, and confirm account takeover in Azure AD sign-in logs via impossible travel and session-token replay. You finish by choosing the containment action that actually evicts an attacker holding a valid session token. Foundational skills for SOC analysts in lookalike-domain analysis and identity-centric incident response.
MFA Fatigue: The Notification Flood
In this guided walkthrough, you will step into the shoes of a SOC analyst investigating a modern identity-based attack. The threat landscape in 2026 has shifted: adversaries are no longer just 'breaking in'; they are logging in. You will analyze real-time identity signals, correlate disparate log sources across a hybrid cloud environment, and identify the markers of an MFA fatigue attack used by the FlowerStorm phishing kit. This scenario highlights the critical importance of behavioral analysis over simple IOC matching in an era of malware-free intrusions and compromised human identities.
Open Bucket, Open Books
A payments vendor's S3 bucket of bank-mandate PDFs was quietly made world-readable. Anonymous outsiders listed and bulk-downloaded the data with no credentials. Work the cloud audit trail to reconstruct the exposure and the theft.