Frozen Assets: The Snowflake Tenant Heist
A retailer's Snowflake tenant is accessed with a contractor credential lifted from an infostealer log. With no MFA and no network policy to stop it, the actor logs in from VPN-exit IPs, recons with anomalous tooling, and bulk-exfiltrates an entire customer table. Work the Snowflake audit trail to reconstruct the theft.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Spot the foothold
20Production data is meant to be reachable only by the ETL service and BI accounts, with MFA, from the corporate network. Overnight, one login broke that pattern. Identify the Snowflake account behind the suspicious activity.
Trace the first exit node
20The account does not normally sign in from the public internet. Pinpoint the external address behind its first successful authenticated session.
Name the tooling tell
25The intruder's sessions did not use the normal drivers or the browser UI. Identify the unrecognized client application string used to run the reconnaissance and the bulk unload.
Find the staging step
20Before the data left, it was gathered into one place on the platform. Identify the temporary stage the actor created to hold the dump.
Recover the exfiltrated table
20Identify the fully-qualified table whose entire contents were unloaded and downloaded off the platform.
Classify the exfiltration
15Map the way the data left the platform to its MITRE ATT&CK technique.
6 tasks · 120 points total
Training Tools
Cloud Console
Cloud infrastructure logs
SIEM Console
Log analysis & SPL queries
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Cloud concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allEdge Device Exploitation: VPN Zero-Day
Investigate a breach targeting exposed edge security appliances. In this scenario, an attacker exploits Ivanti Connect Secure CVE-2025-22457 to obtain unauthenticated code execution, spawns a shell from the gateway web process, retrieves a Linux payload, and attempts to preserve access using edge-device service abuse patterns similar to FortiGate SSL-VPN post-exploitation tradecraft. Analyze SIEM, XDR, and firewall evidence to identify the spawned shell, suspicious domain, local sync script, and defensive block policy.
Zerologon DC takeover → ransomware
An unprivileged phishing foothold becomes a domain-wide ransomware outbreak in hours. The attacker abuses the Zerologon flaw to reset a domain controller's machine-account password, pivots controller-to-controller, and encrypts the estate after gutting the backups. Work the Windows Security log, the endpoint process tree, and the perimeter traffic to reconstruct the takeover.
Exchange ProxyShell: Domain-Wide Ransomware
An internet-facing Exchange server falls to ProxyShell, dropping ASPX web shells that run as SYSTEM. The attacker re-enables a built-in account, dumps LSASS with a Windows DLL, tunnels out with Plink and FRP, moves laterally over RDP, and encrypts the domain with its own BitLocker and DiskCryptor, no ransomware binary in sight. Work the Exchange logs, the endpoint process tree, and the perimeter traffic to reconstruct the intrusion.