Kerberoasting: Service Ticket to Domain Admin
In this scenario, you will investigate a high-speed identity-based attack. Starting from an edge device exploitation, an adversary moves laterally to a domain-joined workstation and targets Active Directory. You must analyze SIEM logs for Kerberos ticket anomalies (RC4 encryption), correlate XDR process trees for Impacket usage, and identify the 'malware-free' techniques used to escalate privileges to Domain Admin.
Start this operation
Create your free account and begin immediately.
Get Early Access — FreeFree forever — no credit card required
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Tracing the Root of the Malicious Execution
50An alert was triggered on corp-wks-001 involving an unusual sequence of system calls. Analyze the process hierarchy beginning at 2025-05-10T13:29:00Z to determine which interpreter was spawned as a child process of the command-line interface.
Investigating Anomalous Python Execution
40An alert was triggered on 2025-05-11T01:59:58.466Z involving an unusual child process spawned under python.exe. Review the endpoint telemetry to determine the exact filename of the script executed from the command line.
Identifying Suspicious Network Destinations
15After a suspicious file was executed on the corporate workstation, the system initiated an outbound connection to an internal server. Review the endpoint details around 2025-05-10T13:30:03.830Z to find the target domain name.
Analyze Suspicious Execution Chain on corp-wks-002
100An alert indicates that anita.garcia executed a third-party CLI tool that spawned several child processes in rapid succession. You must reconstruct the execution timeline to determine the specific process responsible for the final stage of this unknown attack vector.
Investigating Suspicious Network Connections
15After the execution of a suspicious script on corp-wks-001 at 2025-05-14T23:55:05.457Z, network logs indicate a connection to an unknown external host. Analyze the SIEM event messages to determine where the data was being sent.
Identifying Suspicious Network Communications
15An alert triggered for unusual outbound traffic originating from a common productivity application on user john.miller's workstation. Analyze the network logs to determine which specific remote server address was being contacted during this event.
Investigating Anomalous CLI Network Activity
50An alert was triggered for an unauthorized binary, chatgpt-integrated-cli.exe, executing on corp-wks-142. Investigation is required to determine the specific network port this application used to communicate with an external endpoint during the incident.
Investigating Anomalous Activity on corp-wks-001
50Our monitoring system flagged an unusual login session for user sarah.chen on corp-wks-001. Analyze the SIEM event messages to determine which specific process was executed immediately following the initial command-line activity.
8 tasks · 335 points total
Start investigationTraining Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
Ready to investigate?
Create your free account and begin immediately.
Get Early Access — FreeFree forever — no credit card required
More Operations
View allScattered Spider: Identity-First Attack Chain
Investigate a high-sophistication intrusion by UNC3944 (Scattered Spider). This scenario simulates a multi-stage attack starting from social engineering and MFA fatigue, progressing through the exploitation of unmanaged edge devices, and culminating in a 'Bring Your Own Vulnerable Driver' (BYOVD) technique to blind kernel-level security agents. Analysts must correlate identity providers, cloud sign-ins, and deep endpoint forensics to reconstruct the timeline and identify the breakout speed of this financially motivated threat actor.
Fake Zoom to Ransomware: The Social Engineering Pipeline
In this advanced SOC simulation, you will investigate a multi-stage intrusion that began with a drive-by download of a trojanized Zoom installer. The attack progressed through several stages of loader execution, including d3f@ckloader and IDAT loader, eventually leading to the deployment of high-end C2 frameworks like Cobalt Strike and Brute Ratel. You must trace the attacker's path from the initial web-based compromise, through lateral movement via RDP tunneling and proxy tools, to the final mass-deployment of BlackSuit ransomware via enterprise management software. This scenario is based on real-world 2025 threat intelligence and requires deep analysis of SIEM, XDR, and Firewall telemetry to reconstruct the full kill chain.
Black Basta: Email Bomb to Encryption
Investigate a sophisticated Ransomware-as-a-Service (RaaS) campaign involving Black Basta and Cactus TTPs. This scenario tracks a multi-stage attack from initial social engineering via Microsoft Teams and Quick Assist to advanced persistence using DLL side-loading in OneDrive. You will analyze how attackers move from identity-based initial access to full domain compromise and ESXi virtualization host encryption. The investigation requires correlating evidence across SIEM logs, XDR process trees, and firewall traffic to uncover hidden C2 channels and data exfiltration patterns occurring during off-hours.