Black Basta: Email Bomb to Encryption
Investigate a sophisticated Ransomware-as-a-Service (RaaS) campaign involving Black Basta and Cactus TTPs. This scenario tracks a multi-stage attack from initial social engineering via Microsoft Teams and Quick Assist to advanced persistence using DLL side-loading in OneDrive. You will analyze how attackers move from identity-based initial access to full domain compromise and ESXi virtualization host encryption. The investigation requires correlating evidence across SIEM logs, XDR process trees, and firewall traffic to uncover hidden C2 channels and data exfiltration patterns occurring during off-hours.
Start this operation
Requires a Pro subscription.
View Pro PlansFree forever — no credit card required
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Identify Compromised Host via Lateral Movement Patterns
50After anita.garcia reported unusual behavior on her workstation, we noticed a series of failed authentication attempts followed by a successful remote execution. Investigate the network traffic logs to determine which internal host was targeted and fully compromised by the attacker.
Tracing the Command and Control Beacon
50Around 2025-05-03T11:05:12Z, an alert was triggered indicating a potential C2 heartbeat. Analyze the firewall traffic to determine which internal workstation was communicating with the external adversary's infrastructure.
Identifying the Compromised Internal Endpoint
35A high-severity alert triggered when cmd.exe was spawned by an unexpected parent process. Following this execution, an outbound connection was logged; you need to identify the internal victim host that was compromised during this sequence.
Identifying Tunneling Artifacts on corp-wks-112
100The user anita.garcia reported unusual system behavior while using quickassist.exe. Initial triage suggests an unauthorized data exfiltration attempt or proxy setup occurred shortly after the session began. Investigate the timeline events to find the name of the file that was dropped or referenced during this phase.
Identify the Compromised Internal Host
50After anita.garcia reported unusual behavior on corp-wks-482, we noticed a suspicious process execution involving quickassist.exe at 2025-05-04T05:30:38.653Z. You must identify which internal host is now communicating with a known malicious command-and-control infrastructure.
Investigating Suspicious Network Communications
50An alert triggered for suspicious activity involving onedrivestandaloneupdater.exe on workstation corp-wks-482. You need to investigate the network connection events at 2025-05-01T10:15:06.726Z to determine which command-and-control domain the workstation was attempting to reach.
Identifying the Compromised Internal Endpoint
50Around 2025-05-01T13:59:55.654Z, an alert was triggered indicating a potential data exfiltration attempt. Investigate the connection logs to determine which internal host was communicating with a high-reputation threat actor IP during this timeframe.
Deep Analysis of Lateral Movement via Quick Assist
100At 2025-05-04T17:05:54.193Z, an unusual execution chain was observed starting from quickassist.exe. You must investigate the process tree to identify the final payload launched through multiple nested child processes before the session was terminated.
Investigating Suspicious Persistence in OneDrive Updates
100An alert triggered on 2025-05-04T23:17:11.610Z involving a suspicious execution of onedrivestandaloneupdater.exe. Analyze the process details on corp-wks-482 to determine if the file signature and hash match the known-good Microsoft binary or if it has been replaced by an attacker.
Identify the Compromised Internal Endpoint
50After anita.garcia reported unusual behavior on her workstation, our network monitoring detected a surge in outbound traffic to an unauthorized external domain. Analyze the network telemetry around 2025-05-02T09:49:55.055Z to identify which internal system has been compromised by the attacker.
10 tasks · 635 points total
Start investigationTraining Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
This operation requires a Pro subscription.
View Pro PlansFree forever — no credit card required
More Operations
View allScattered Spider: Identity-First Attack Chain
Investigate a high-sophistication intrusion by UNC3944 (Scattered Spider). This scenario simulates a multi-stage attack starting from social engineering and MFA fatigue, progressing through the exploitation of unmanaged edge devices, and culminating in a 'Bring Your Own Vulnerable Driver' (BYOVD) technique to blind kernel-level security agents. Analysts must correlate identity providers, cloud sign-ins, and deep endpoint forensics to reconstruct the timeline and identify the breakout speed of this financially motivated threat actor.
Fake Zoom to Ransomware: The Social Engineering Pipeline
In this advanced SOC simulation, you will investigate a multi-stage intrusion that began with a drive-by download of a trojanized Zoom installer. The attack progressed through several stages of loader execution, including d3f@ckloader and IDAT loader, eventually leading to the deployment of high-end C2 frameworks like Cobalt Strike and Brute Ratel. You must trace the attacker's path from the initial web-based compromise, through lateral movement via RDP tunneling and proxy tools, to the final mass-deployment of BlackSuit ransomware via enterprise management software. This scenario is based on real-world 2025 threat intelligence and requires deep analysis of SIEM, XDR, and Firewall telemetry to reconstruct the full kill chain.
Akira Ransomware: Full Kill Chain IR
The intrusion began with a search engine advertisement and ended with the deployment of Akira ransomware. This scenario covers the full 2025 threat landscape, emphasizing identity-based compromise, MFA bypass via AiTM kits, and rapid lateral movement toward Active Directory. Analysts must navigate a complex environment of Windows workstations, Domain Controllers, and Cisco VPN infrastructure to reconstruct the timeline from initial access to data exfiltration and final encryption.