QR Code Phishing: Scan to Compromise
In this scenario, you will investigate a modern 'Quishing' (QR phishing) attack that bypassed traditional email filters by hiding its payload inside an image. You will trace the full chain: a spoofed MFA-enrollment lure sent from purpose-built infrastructure, a redirect server that conceals the final destination, and an Evilginx-style adversary-in-the-middle page that stole an authenticated session cookie despite MFA. You will then follow the attacker's post-compromise moves (Graph API mailbox enumeration, SharePoint exfiltration, and a hidden inbox forwarding rule) and choose the containment action that actually evicts them.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
QR Code Phishing
5Start with why quishing works: the email body contains an image rather than a clickable URL, so security controls must decode and inspect the QR payload. Read the setup before following the logs.
The Redirect Server
10Analyze the SIEM and email gateway logs to identify the first redirect server in the phishing chain: the IP address that the decoded QR code URL initially resolves to.
The Credential Harvesting Server
10Trace the victim after the redirect. Review the captured web and identity events to find where the fake Microsoft login page received the credential submission.
Infrastructure Mapping
10Separate phishing delivery infrastructure from post-compromise operations. After the session theft, use sign-in telemetry to identify the server the attacker used to access Microsoft services as Sarah.
The Phishing Domain
10Do not trust the display sender. Inspect headers and supporting gateway telemetry to identify the phishing management domain behind the QR-code campaign infrastructure.
Containment
5Finish with containment for session-cookie theft and mailbox abuse. Review the confirmed server chain, stolen-session activity, and inbox-rule persistence before choosing the action that ends access.
6 tasks · 50 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.