AdvancedSIEMXDRFirewallPRO

APT Investigation: Bluebottle Financial Sector Campaign

A deep-dive investigation into a sophisticated multi-stage attack targeting financial institutions in Francophone Africa. Analysts will trace the infection from malicious ISO mounts through GuLoader execution, defense evasion via signed kernel drivers, and lateral movement using dual-use tools like Ngrok and PsExec. This scenario is based on real-world threat intelligence from the Symantec Threat Hunter Team regarding the Bluebottle/OPERA1ER group.

28 tasks

320 points

Pro

Start this operation

Requires a Pro subscription.

View Pro Plans

Free forever — no credit card required

Investigation Tasks

Complete each task by investigating alerts and submitting your findings.

Initial Lure Execution Analysis

SOC{filename.exe}Hint available

GuLoader Injection Detection

SOC{process_name.exe}Hint available

Kernel Driver Defense Evasion

SOC{service_name}Hint available

Lateral Movement via PsExec

SOC{hostname}Hint available

Ngrok Tunneling Correlation

SOC{domain_name}Hint available

RDP Persistence Mechanism

SOC{tool_name}Hint available

Credential Theft Pattern Analysis

SOC{RegistryValueName}Hint available

Malicious .NET Download Source

SOC{ip_address}Hint available

Macro Execution Parent Process

SOC{PROCESS.EXE}Hint available

Encrypted Payload Retrieval

SOC{filename.bin}Hint available

Registry Persistence Mechanism

SOC{KeyName}Hint available

NetWire C2 Port Identification

SOC{port_number}Hint available

Brute Force Source Correlation

Identify the external IP address responsible for multiple failed RemoteInteractive logon attempts against the workstation FIN-WS-06, as recorded in the security event logs.

SOC{...}

Phishing Document Source Domain

SOC{domain.com}Hint available

GuLoader Binary Name

SOC{filename.exe}Hint available

C2 Domain Correlation

SOC{domain.name}Hint available

C2 Server IP Identification

SOC{ip_address}Hint available

Script Interpreter Analysis

SOC{binary.exe}Hint available

RAT Payload Hosting

SOC{http://url/path}Hint available

Reflective Loading Detection

SOC{InjectionType}Hint available

Sandbox Evasion Check

SOC{APICall}Hint available

Cobalt Strike Beacon Detection

SOC{process.exe}Hint available

RDP Lateral Movement Source

SOC{ip_address}Hint available

Unauthorized Data Transfer

SOC{ip_address}Hint available

Phishing Attachment Filename

SOC{filename.doc}Hint available

Suspicious Notepad Injection

SOC{Malware.exe}Hint available

Encrypted C2 Traffic Analysis

SOC{protocol_name}Hint available

Keylogging Activity Correlation

SOC{TXXXX.XXX}Hint available

28 tasks · 320 points total

Start investigation

Training Tools

SIEM Console

Log analysis & SPL queries

XDR Console

Endpoint detection & response

Firewall Console

Network traffic analysis

Skills You'll Build

Investigate realistic security alerts

SIEM log analysis

XDR log analysis

Firewall log analysis

MITRE ATT&CK technique identification

Triage decisions: escalate, investigate, or close

Evidence collection and documentation

Job-ready incident response methodology

Advanced

Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.

Prerequisites

Basic understanding of security alerts
Experience with log analysis tools
Familiarity with SIEM concepts
Familiarity with XDR concepts
Familiarity with Firewall concepts

Ready to investigate?

This operation requires a Pro subscription.

View Pro Plans

Free forever — no credit card required

More Operations

View all

BeginnerSIEMXDR

ClickFix: The Fake CAPTCHA Trap

Investigate a modern 'ClickFix' social engineering attack where a user was tricked into executing a malicious PowerShell command via a fake CAPTCHA interface. You will analyze SIEM and XDR telemetry to trace the infection from the initial web lure to the deployment of an infostealer.

30m20 pts

BeginnerSIEMXDR

Phishing Investigation: ZipLine Supply Chain Campaign

Investigate a sophisticated social engineering campaign targeting manufacturing supply chains. You will analyze a 'reversed' phishing flow where attackers use 'Contact Us' forms to trick employees into initiating email conversations, leading to the deployment of the custom MixShell in-memory implant via DNS tunneling.

45m75 pts

BeginnerSIEM

Credential Harvesting: The Lookalike Login

An investigation into a modern phishing campaign targeting critical infrastructure. You will analyze email headers for domain spoofing, identify 'Paste and Run' execution chains, and track the delivery of the LummaC2 information stealer through SIEM logs.

30m20 pts