Building a Backdoor
Velodraft Systems runs its release pipeline on a self-hosted TeamCity server that was left accessible from the internet on an unpatched build. An attacker exploited an authentication-bypass flaw to create a rogue administrator without credentials, harvested stored VCS secrets and cloud keys, then planted a malicious build step in the production release pipeline. When the next scheduled build fired, both CI build agents pulled and executed an implant that beaconed out to an attacker-controlled domain. Reconstruct the intrusion chain from the TeamCity audit trail and the build-agent XDR data.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Identify the entry point
20The TeamCity server at Velodraft Systems started generating unusual audit entries in the early hours of the morning. Before anything else, establish how an outside address reached the server's administrative API without any valid credentials.
Trace the rogue account
25A few minutes after the initial probe, a new account appeared in TeamCity with full administrator privileges. Identify the username that was created.
Locate the pipeline modification
25Authenticated as the rogue admin, the attacker did not stop at credential theft. They modified the CI/CD pipeline to plant something that would run every time engineers triggered a build. Identify which build configuration was modified.
Find where the implant was staged
20When the scheduled build ran, the rogue step pulled a binary from an external host. Identify the domain the binary was downloaded from.
Identify the implant on disk
20The downloaded binary was designed to avoid standing out. Locate it by examining what the build agents wrote to disk and name the file that was dropped.
Map the persistence method to MITRE
20Injecting a malicious build step into a production CI/CD pipeline so that attacker code runs automatically with every build is a well-documented supply-chain technique. Identify the MITRE ATT&CK technique ID that covers this class of attack.
Trace the C2 beacon destination
25After the implant launched on both build agents, it immediately established a persistent outbound connection. Identify the domain it connected to.
7 tasks · 155 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe One-Letter Vendor: Typosquat Invoice Thread Hijack
An accounts-payable team received what looked like a routine reply on an open invoice thread from a trusted supplier. It passed every mail gateway, because the From domain authenticated perfectly. The catch was four mailboxes in the CC field on a domain one letter off the real vendor, quietly hijacking the thread to redirect a six-figure payment to an attacker account. No malware, no account takeover, just mail authentication's blind spot. Work the headers, authentication results, and message traces to reconstruct the vendor-email-compromise fraud.
Cobalt Strike: Beacon Detection
In this scenario, a threat actor has gained a foothold in a corporate environment. You will serve as a SOC Analyst tasked with identifying the initial infection vector, tracing lateral movement, and uncovering the final objectives of the intrusion. This room focuses on detecting beacon traffic, process injection patterns, and the hands-on-keyboard activity that precedes encryption. You will utilize SIEM logs and XDR telemetry to reconstruct the attack timeline and identify critical Indicators of Compromise (IOCs).
Finance Mailbox Takeover at MegaCorp Logistics
A finance analyst at MegaCorp Logistics reported that colleagues were receiving replies to messages she never sent, and her account was disabled while the investigation runs. You have the SIEM feed and the endpoint XDR telemetry for the workstation estate and the mail platform, covering the week around the report. Reconstruct what happened: which host produced the endpoint evidence, what its browser reached, how the account was taken over, and what was left behind on the mail platform so the containment plan is complete.