Weaponized SVG: Embedded Code in an Image Attachment
A treasury analyst at a bank opens what looks like a SWIFT payment confirmation, clicks the button inside it, and no document ever appears. Minutes later her workstation is running code out of her own user profile and holding an encrypted session to a host it has never contacted before. Walk the mail gateway, the file artifacts and the endpoint process tree step by step, from the delivery that started it to the beacon that followed.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: an image that was not just an image
0A treasury workstation started talking to an external host on its own this morning, minutes after the analyst opened what looked like a payment confirmation. Before you dig into the endpoint evidence, get oriented on how this attack began.
Trace the delivery to its sender
15Start at the mail gateway. Three messages reached Priya's mailbox in the same stretch of the morning, and one of them is the delivery that started this incident. Work out which record that is, then recover the address it was sent from.
Find the file that wrote a ZIP to disk
15Three files appeared in Priya's Downloads folder in the minutes around the click, and none of them is a payment confirmation. Read the file-monitor timeline and name the file the others came out of.
Follow the execution chain
15Priya extracted the archive and opened what was inside it. Read the process tree from larch-ws-0418 and name the process that executed that extracted file itself.
Name the command-and-control host
15Two outbound connections follow the loader in this window and they are not doing the same job. Identify the external host that the archive dropped into Priya's profile reached out to.
Classify the scripting technique
10Map the execution method to MITRE ATT&CK. Use the recap below to work out what the endpoint was actually asked to run, then name the technique ATT&CK assigns to it.
6 tasks · 70 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with Email concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.