Frozen Assets: The Snowflake Tenant Heist
A retailer's Snowflake tenant is accessed with a contractor credential lifted from an infostealer log. With no MFA and no network policy to stop it, the actor logs in from VPN-exit IPs, recons with anomalous tooling, and bulk-exfiltrates an entire customer table. Work the Snowflake audit trail to reconstruct the theft.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Spot the foothold
20Production data is meant to be reachable only by the ETL service and BI accounts, with MFA, from the corporate network. Overnight, one login broke that pattern. Identify the Snowflake account behind the suspicious activity.
Trace the first exit node
20The account does not normally sign in from the public internet. Pinpoint the external address behind its first successful authenticated session.
Name the tooling tell
25The intruder's sessions did not use the normal drivers or the browser UI. Identify the unrecognized client application string used to run the reconnaissance and the bulk unload.
Find the staging step
20Before the data left, it was gathered into one place on the platform. Identify the temporary stage the actor created to hold the dump.
Recover the exfiltrated table
20Identify the fully-qualified table whose entire contents were unloaded and downloaded off the platform.
Classify the exfiltration
15Map the way the data left the platform to its MITRE ATT&CK technique.
6 tasks · 120 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Cloud concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.