ScreenConnect "SlashAndGrab": Auth-Bypass to RMM Abuse
An MSP's internet-facing ScreenConnect server is hit with the SlashAndGrab chain, a setup-wizard auth bypass mints a rogue administrator, a path-traversal write plants a malicious extension, and the attacker then turns the trusted RMM against the fleet it manages to push a generic encrypting payload. The catch: the abuse looks exactly like legitimate MSP administration. Work the ScreenConnect logs, the endpoint process tree, and the perimeter egress to tell them apart.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the foothold
20Overnight, the MSP's internet-facing ScreenConnect server served a page it should never serve again. Work the ScreenConnect and web request logs and isolate the external address whose request re-triggered the server's first-run setup flow.
Catch the rogue account
20The setup re-trigger existed to hand the attacker a way back in. Identify the new privileged account that was created on the ScreenConnect server.
Name the planted extension
25Logged in as the new admin, the attacker planted code on the RMM server itself so it would run with the service's privileges. Identify the malicious file written into the ScreenConnect extensions tree.
Separate abuse from legitimate RMM
25The attacker then used the RMM exactly as a technician would, to reach the managed fleet and stage a payload. Identify the external host the managed endpoints downloaded that payload from.
Spot the cover-up
15Before leaving, the attacker tried to erase the trail on a managed endpoint. Identify the MITRE ATT&CK technique for clearing Windows event logs to remove evidence.
5 tasks · 105 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allAD CS ESC1: Certificate Template Abuse to Domain Admin
An ordinary user becomes a Domain Admin without stealing a password. A misconfigured certificate template lets the enrollee supply the subject, so the user requests a certificate whose Subject Alternative Name names a Domain Admin, and the CA issues it. The forged certificate is then used for PKINIT to authenticate as that admin. Work the certificate-authority records, the endpoint process tree, and the domain controller's Kerberos logs to reconstruct the escalation.
Citrix Bleed: Session Token Hijack (CVE-2023-4966)
A Citrix NetScaler ADC/Gateway running a vulnerable firmware version leaked an authenticated VPN session token through a heap memory disclosure flaw. An attacker captured the token from the HTTP response, replayed it to bypass MFA, and landed inside the network as a legitimate user. Reconstruct the exploit, the stolen credential, the lateral RDP move, and the post-exploitation activity from the NetScaler logs, firewall traffic, and XDR endpoint telemetry.
GoAnywhere MFT: Cl0p Deserialization Exploit (CVE-2023-0669)
A GoAnywhere MFT admin console left reachable from the internet was compromised through a pre-authentication Java deserialization vulnerability. An attacker dropped a persistent Java agent, provisioned a rogue admin account, enumerated hundreds of managed file transfers, and exfiltrated a bulk archive of partner-client data. Reconstruct the full chain from the GoAnywhere web logs and the perimeter firewall.