The Half-Second Tell
A Linux hosting fleet quietly picks up an affected xz-utils / liblzma 5.6.1 build, and the SSH daemon's login path is no longer its own. There is no crash and no malware drop, only a shared object whose hash moved, an sshd that forks a shell it never should, a half-second of extra login latency, and a root key the fleet never issued. Work the package, file-integrity, auth, and perimeter records to surface the subtle host artifacts of CVE-2024-3094 and scope the affected version.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the host that fooled the latency probe
45Overnight, synthetic monitoring on the hosting fleet flagged an SSH login that took far longer than it should have. Work the host telemetry and identify the edge node whose login latency first broke the threshold.
Catch the SSH daemon doing something it never should
60A slow login is a symptom, not a cause. On that same node, pivot into the process-execution records and find the moment the SSH daemon behaved in a way a healthy sshd never does.
Identify the file behind the tampered login path
60The SSH daemon's behavior changed without anyone editing sshd itself. Find the on-disk object whose integrity changed underneath it.
Pin the affected version
55For the fleet-wide remediation ticket, leadership needs the exact version that has to be ripped out. Determine the affected liblzma/xz version that landed on the hosts.
Trace how the package reached the fleet
50The edge nodes did not each fetch this from the internet, it came from inside. Identify the host the affected package was built and staged on before it rolled to the fleet.
Identify the unprovisioned login
60The tampered authentication path was not theoretical, someone used it. Find the external address that completed a root login the fleet never authorized.
Confirm the exposure on the perimeter
45Corroborate that external session at the network edge. Confirm the operator's traffic reached the affected node through the firewall and name the rule that let it in.
Classify the root cause
40Close the incident report by mapping the root cause to MITRE ATT&CK. Identify the technique that describes how the affected library was delivered into the environment in the first place.
8 tasks · 415 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allScattered Spider: Identity-First Attack Chain
Investigate a high-sophistication intrusion by UNC3944 (Scattered Spider). This scenario simulates a multi-stage attack starting from social engineering and MFA fatigue, progressing through the exploitation of unmanaged edge devices, and culminating in a 'Bring Your Own Vulnerable Driver' (BYOVD) technique to blind kernel-level security agents. Analysts must correlate identity providers, cloud sign-ins, and deep endpoint forensics to reconstruct the timeline and identify the breakout speed of this financially motivated threat actor.
Volt Typhoon: living-off-the-land in critical infrastructure
No malware, no ransomware, no payload to scan for, just native Windows binaries used in an abnormal sequence and a stolen administrator credential. A stealth operator plants a tiny web shell on a water utility's internet-facing host, dumps LSASS with a signed system DLL, routes C2 through a compromised home router, and exports the entire Active Directory database off the domain controller before clearing the logs. Work the Windows Security log, the endpoint process tree, and the perimeter traffic to separate the living-off-the-land activity from a heavy baseline of legitimate admin work.
Medusa RaaS: VPN access to enterprise encryption
A regional healthcare provider is breached through its internet-facing SSL-VPN, and within a shift a Medusa affiliate harvests domain credentials, pivots to the domain controller and backup servers, persists with a rogue remote-management agent hidden among the estate's legitimate ones, steals patient data to cloud storage, and deploys ransomware. Work the VPN authentication records, the endpoint process tree, and the perimeter traffic to reconstruct the intrusion end to end and tell the abuse apart from a heavy baseline of normal remote-management activity.