Hide Your RDP
An internet-facing RDP server at a logistics firm is password-sprayed into, and within hours a RansomHub affiliate dumps credentials, pivots to the domain controller and backup servers, steals finance data over SFTP, and deploys ransomware. Work the authentication records, the endpoint process tree, and the perimeter traffic to reconstruct the intrusion end to end.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the account that fell to the spray
20An internet-facing RDP server generated a storm of failed remote logons across several staff accounts this morning, and one of those accounts then logged in successfully. Work the Windows authentication records and determine which single account the attacker sprayed into and used to gain the foothold.
Pin the foothold source
20The compromised account let an outsider in over RDP. Identify the external address that landed the successful remote logon, so it can be blocked and hunted across the estate.
Catch the directory theft
30Soon after the break-in, an account that has no business doing so asked the domain controller to hand over directory replication data. Identify the host where that domain-replication event was recorded.
Name the persistence agent
25With domain-admin credentials in hand, the operator reached the backup servers and installed software to keep a way back in. Identify the remote-management agent that was installed as a service for persistence.
Follow the data out
25Before the ransomware fired, finance data was copied out of the network. Identify the external host the stolen data was transferred to.
Classify the recovery sabotage
15Just before encryption, the operator made sure the victim could not roll back. Map that anti-recovery activity to the MITRE ATT&CK technique it represents.
6 tasks · 135 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.