AdvancedSIEMXDRPRO

Scattered Spider: Identity-First Attack Chain

Investigate a high-sophistication intrusion by UNC3944 (Scattered Spider). This scenario simulates a multi-stage attack starting from social engineering and MFA fatigue, progressing through the exploitation of unmanaged edge devices, and culminating in a 'Bring Your Own Vulnerable Driver' (BYOVD) technique to blind kernel-level security agents. Analysts must correlate identity providers, cloud sign-ins, and deep endpoint forensics to reconstruct the timeline and identify the breakout speed of this financially motivated threat actor.

1h 30m

10 tasks

850 points

Pro

Start this operation

Requires a Pro subscription.

View Pro Plans

Free forever — no credit card required

Investigation Tasks

Complete each task by investigating alerts and submitting your findings.

Investigating Lateral Movement and Credential Dumping

After gaining access to corp-srv-ad01 via services.exe, the attacker executed a known Impacket tool to extract the NTDS.dit database. Examine the XDR Timeline around 2024-05-09T23:45:06.235Z to find the script responsible for this activity.

SOC{...}Hint available

Investigating Kernel-Level Persistence on corp-wks-9901

100

An alert triggered at 2024-05-09T03:41:58.606Z indicating a suspicious process execution involving kdmapper.exe on corp-wks-9901. Analyze the process execution logs in the SIEM to find the hash of the binary that was executed to bypass driver signature enforcement.

SOC{...}Hint available

Uncovering Kernel-Level Persistence Artifacts

100

At 2024-05-08T02:31:05Z, a suspicious process was executed by the user claudia.vance that appears to interact with system memory. You must investigate the command line arguments and the resulting file activity to identify the driver being manually mapped into the kernel.

SOC{...}Hint available

Investigating Execution Anomalies on corp-wks-9901

100

A high-severity alert was triggered when a user account, claudia.vance, executed a process that attempted to bypass local security controls. Analysts must review the event descriptions within the XDR Timeline to determine which interpreter was invoked to facilitate this activity.

SOC{...}Hint available

Investigating Kernel-Level Persistence on corp-wks-9901

100

An alert triggered for potential driver manual mapping on corp-wks-9901. Review the process tree for services.exe to find the malicious binary executed by the SYSTEM account that attempted to bypass security controls.

SOC{...}Hint available

Investigating Kernel-Level Persistence via Driver Loading

100

The adversary successfully executed kdmapper.exe on the corp-wks-9901 workstation to bypass driver signature enforcement. You must determine the exact name of the malicious driver file that was dropped and executed during this sequence to establish the extent of kernel-level compromise.

SOC{...}Hint available

Tracing the Origin of the Kernel-Mode Driver Load

100

During a deep-dive timeline reconstruction, we observed an unusual driver mapper execution occurring at 2024-05-31T01:59:56.871Z. You need to examine the SIEM records for this event to determine which telemetry provider reported this activity to the central repository.

SOC{...}Hint available

Unusual DNS Resolution on corp-wks-8821

An alert was triggered for corp-wks-8821 involving kdmapper.exe, which is often used for manual driver loading. Evidence suggests the process initiated a network connection at 2024-05-01T09:12:33Z; investigate the message logs to determine the target domain.

SOC{...}Hint available

Investigating Suspicious Beaconing Activity

After the execution of a suspicious binary on corp-wks-9901 around 2024-05-08T02:30:15Z, the system initiated an outbound connection to an unauthorized external gateway. Analyze the endpoint activity to determine the destination address being used to exfiltrate data.

SOC{...}Hint available

Phishing Reconstruction: Identifying the Initial Entry Document

100

An alert triggered for suspicious driver loading via kdmapper.exe, but we need to trace the execution chain back to the start. Analyze the SIEM event messages for host corp-wks-8821 to find which productivity application was used to launch the initial stage of the attack.

SOC{...}Hint available

10 tasks · 850 points total

Start investigation

Training Tools

SIEM Console

Log analysis & SPL queries

XDR Console

Endpoint detection & response

Skills You'll Build

Investigate realistic security alerts

SIEM log analysis

XDR log analysis

MITRE ATT&CK technique identification

Triage decisions: escalate, investigate, or close

Evidence collection and documentation

Job-ready incident response methodology

Advanced

Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.

Prerequisites

Basic understanding of security alerts
Experience with log analysis tools
Familiarity with SIEM concepts
Familiarity with XDR concepts

Ready to investigate?

This operation requires a Pro subscription.

View Pro Plans

Free forever — no credit card required

More Operations

View all

AdvancedSIEMXDR

Fake Zoom to Ransomware: The Social Engineering Pipeline

In this advanced SOC simulation, you will investigate a multi-stage intrusion that began with a drive-by download of a trojanized Zoom installer. The attack progressed through several stages of loader execution, including d3f@ckloader and IDAT loader, eventually leading to the deployment of high-end C2 frameworks like Cobalt Strike and Brute Ratel. You must trace the attacker's path from the initial web-based compromise, through lateral movement via RDP tunneling and proxy tools, to the final mass-deployment of BlackSuit ransomware via enterprise management software. This scenario is based on real-world 2025 threat intelligence and requires deep analysis of SIEM, XDR, and Firewall telemetry to reconstruct the full kill chain.

2h40 pts

AdvancedSIEMXDR

Black Basta: Email Bomb to Encryption

Investigate a sophisticated Ransomware-as-a-Service (RaaS) campaign involving Black Basta and Cactus TTPs. This scenario tracks a multi-stage attack from initial social engineering via Microsoft Teams and Quick Assist to advanced persistence using DLL side-loading in OneDrive. You will analyze how attackers move from identity-based initial access to full domain compromise and ESXi virtualization host encryption. The investigation requires correlating evidence across SIEM logs, XDR process trees, and firewall traffic to uncover hidden C2 channels and data exfiltration patterns occurring during off-hours.

1h 30m40 pts

AdvancedSIEMXDR

Akira Ransomware: Full Kill Chain IR

The intrusion began with a search engine advertisement and ended with the deployment of Akira ransomware. This scenario covers the full 2025 threat landscape, emphasizing identity-based compromise, MFA bypass via AiTM kits, and rapid lateral movement toward Active Directory. Analysts must navigate a complex environment of Windows workstations, Domain Controllers, and Cisco VPN infrastructure to reconstruct the timeline from initial access to data exfiltration and final encryption.

2h50 pts