The One-Letter Vendor: Typosquat Invoice Thread Hijack
An accounts-payable team received what looked like a routine reply on an open invoice thread from a trusted supplier. It passed every mail gateway, because the From domain authenticated perfectly. The catch was four mailboxes in the CC field on a domain one letter off the real vendor, quietly hijacking the thread to redirect a six-figure payment to an attacker account. No malware, no account takeover, just mail authentication's blind spot. Work the headers, authentication results, and message traces to reconstruct the vendor-email-compromise fraud.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Identify the look-alike domain
40The whole intrusion hinges on one registered domain that almost matches a real supplier. Identify the domain the operator controlled.
Explain why the gateways passed it
35Every enterprise mail gateway delivered the message clean. Identify the authentication result that let it through.
Name the hijacked invoice thread's target
35The operator was after one specific outstanding payment. Identify the open invoice number they tried to redirect.
Recover the attachment indicator
35Pin down a huntable file indicator for the fraudulent invoice PDFs. Provide the MD5 of the 30092 attachment.
Trace the injecting host
35Although authentication passed, the message did not originate from the vendor's real mail path. Identify the originating sending host.
Classify the impersonation
35Name what the operator was fundamentally doing to the finance team. Classify the technique with its MITRE ATT&CK ID.
7 tasks · 215 points total
Training Tools
Email Console
Email header & content analysis
SIEM Console
Log analysis & SPL queries
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Email concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allTrusted Tool, Hostile Hands: Atera RMM Foothold
A phishing-delivered intrusion that weaponized a legitimate remote-monitoring tool instead of custom malware. A finance analyst was lured by a grant-program email whose link pointed at a file-sharing platform; the download was an MSI that silently installed the Atera agent, registered the endpoint to an attacker-controlled tenant, persisted as a Windows service, and beaconed to Atera's cloud over HTTPS. From the vendor console the operator ran PowerShell discovery and staged a follow-on implant, all over trusted infrastructure. Reconstruct the chain from email, SIEM, and endpoint XDR telemetry and classify the key ATT&CK techniques.
Building a Backdoor
Velodraft Systems runs its release pipeline on a self-hosted TeamCity server that was left accessible from the internet on an unpatched build. An attacker exploited an authentication-bypass flaw to create a rogue administrator without credentials, harvested stored VCS secrets and cloud keys, then planted a malicious build step in the production release pipeline. When the next scheduled build fired, both CI build agents pulled and executed an implant that beaconed out to an attacker-controlled domain. Reconstruct the intrusion chain from the TeamCity audit trail and the build-agent XDR data.
Cobalt Strike: Beacon Detection
In this scenario, a threat actor has gained a foothold in a corporate environment. You will serve as a SOC Analyst tasked with identifying the initial infection vector, tracing lateral movement, and uncovering the final objectives of the intrusion. This room focuses on detecting beacon traffic, process injection patterns, and the hands-on-keyboard activity that precedes encryption. You will utilize SIEM logs and XDR telemetry to reconstruct the attack timeline and identify critical Indicators of Compromise (IOCs).