Remcos RAT: Malicious Invoice Attachment
An accounts-payable employee at Harwell Logistics opens what looks like an overdue supplier invoice, and minutes later her workstation is holding a persistent outbound session to an address outside the company on a port nothing else uses. Walk the mail gateway records, the endpoint file artifacts and the process tree in order, pulling one indicator out of each surface until the delivery, the loader, the execution chain and the implant are all named, then close the case with an ATT&CK label.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: the morning the invoice arrived
0A workstation on the accounts payable team generated an unusual alert this morning. Before you open any evidence, get oriented on the environment and on how this case is worked.
Trace the delivery to its sender
15Start at the mail gateway. Three messages reached Nina's mailbox this morning and only one of them is the delivery you are looking for. Separate it from the legitimate traffic and recover the address behind it.
Identify the file that was executed
15The attachment did not stay an attachment. Find the file that came out of it and was executed on the workstation, and name it exactly as it appears on disk.
Follow the execution chain
15Executing that file set off a chain of processes on HARWELL-WKS-14. Use the endpoint process tree to name the process that ran it.
Name the implant that was installed
15The hidden PowerShell process did not stop at downloading. Identify the executable it wrote to disk and launched, the one that gave the attacker interactive control of the workstation.
Classify the execution technique
10Close the case by labelling how the attacker's code was executed. Map that one step to the single MITRE ATT&CK sub-technique that describes it.
6 tasks · 70 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with Email concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.