VPN Brute Force: Credential Attack on the Remote-Access Portal
A password-spray campaign targets the Halcyon Freight SSL-VPN portal from two rotating source IPs, submitting credentials across many accounts to stay under per-account lockout thresholds. One account eventually matches. Reconstruct the spray, identify the compromised account and the operator IP that opened the active session, and trace the first move the attacker made over the tunnel.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Identify the attack pattern in the VPN logs
15Something unusual is happening at the remote-access portal this morning. Before the team escalates, establish what kind of activity you are looking at.
Determine how many accounts were targeted
10The spray hit more than one account. Establish the exact count of distinct account names that appear in the failure events from the 185.159.0.0/24 block.
Find the account where the spray succeeded
15One account in the target list had a password that matched. Identify it.
Identify the IP that opened the active session
15After the spray found a working credential, the attacker shifted to a different IP to establish the actual VPN session. Find that source address.
Trace the movement over the tunnel
20Within minutes of gaining VPN access, the attacker began probing inside the network. Determine which internal host they attempted to reach and over which protocol.
Classify the access technique
15The attacker used legitimate stolen credentials to gain access through the VPN portal. Map this to the MITRE ATT&CK technique for using valid accounts to authenticate to external services.
6 tasks · 90 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allThe Template That Read the Disk
The file-transfer portal that Tideglow Logistics' partners upload to spent a morning returning host files it was never meant to publish, and finished it running an administrator session nobody had logged into. The root cause is CVE-2024-4040 in CrushFTP 10.6.0. Walk the access logs and firewall traffic step by step to trace how a client holding no credentials turned a request parameter into a read of the host, and that read into a takeover.
OneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.