Account Takeover: Impossible-Travel Sign-In
A finance analyst's Microsoft Entra account is accessed without MFA from Moldova 18 minutes after their normal London sign-in. Impossible travel confirmed. The unauthorized session reads the inbox via Graph and adds an external recovery address. Work the Entra audit trail to identify the attacker IP, the compromised mailbox, and the persistence mechanism.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Locate the unauthorized entry point
15One identity authenticated twice to Exchange Online within 18 minutes from locations on opposite sides of Europe. The second sign-in is the attacker. Identify the source IP behind that unauthorized session.
Establish the travel gap
10The impossible-travel alert fires on the time between two sign-ins for the same account. Determine exactly how many minutes elapsed between the legitimate London logon and the attacker's sign-in.
Trace the mailbox access
15After establishing a session, the attacker immediately queried the victim's inbox via Microsoft Graph. Identify the account whose mailbox was targeted.
Find the persistence move
20Before ending the session, the attacker modified the compromised account in a way that outlasts a password reset. Identify the specific account attribute that was changed.
Classify the initial access
15Map the technique by which the attacker gained entry to the Entra tenant to its MITRE ATT&CK sub-technique.
Classify the mailbox collection
10The attacker read the victim's inbox through Microsoft Graph. Identify the MITRE ATT&CK technique that describes this action.
6 tasks · 85 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with Cloud concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.