Public by Default: Sensitive Files Pulled From an Open Azure Blob Container
A sensitive-data exposure caused entirely by a storage misconfiguration. A developer set a production Azure Blob container's public access level to anonymous, an external actor swept the *.blob.core.windows.net namespace and found it, listed it with an unauthenticated List Blobs call, then bulk-downloaded the exports — including a config file with a SQL connection string and a nightly database backup — with AzCopy over anonymous HTTPS. Reconstruct the exposure from Azure Storage diagnostic logs and SIEM corroboration, classifying the discovery and collection techniques, in a case where nothing failed and no credential was ever used.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find the change that opened the container
40Every anonymous read that follows is downstream of one configuration change. Identify the container whose public access level was changed.
Separate the anonymous traffic from the baseline
35The attacker never used a credential. Identify the authentication type that marks every malicious storage request in this incident.
Identify the enumeration host
35Before anything was downloaded, the container was listed. Identify the external IP that ran the first anonymous enumeration.
Classify the bulk download technique
35A burst of anonymous reads emptied the container. Classify the MITRE ATT&CK technique for the bulk download.
Find the most damaging file taken
40Among the downloaded files, one turns a data leak into a credential exposure. Identify the configuration blob that was pulled.
Attribute the root-cause change
35Close the loop on accountability. Identify the principal whose action set the container to anonymous access.
7 tasks · 220 points total
Training Tools
Cloud Console
Cloud infrastructure logs
SIEM Console
Log analysis & SPL queries
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Cloud concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allLazarus: ManageEngine RCE to QuiteRAT Espionage
An internet-facing ManageEngine ServiceDesk Plus appliance at Caldermoor Networks, a regional network and internet service provider, falls to the unauthenticated SAML RCE (CVE-2022-47966). Code runs as the appliance service account, which curls down a QuiteRAT first-stage implant, profiles the host and domain, installs itself as an auto-start Windows service, and beacons to a single HTTPS C2 that carries control and stolen data alike before pulling a CollectionRAT second stage. Work the ManageEngine web logs, the endpoint process tree, and the perimeter egress to reconstruct the intrusion. North-Korea-nexus actor.
From OneNote to RansomNote: A .one Attachment to Nokoyawa Ransomware
A phishing email carrying a malicious OneNote (.one) attachment delivered the IcedID loader, which beaconed quietly for weeks before the operator launched Cobalt Strike, enumerated Active Directory with AdFind, installed AnyDesk for redundancy, moved laterally over RDP, exfiltrated data over SFTP, and deployed Nokoyawa ransomware on the backup and file servers. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
Lingering in the Background: BITS Job Used for Download and Persistence
A teller workstation was cleaned by antivirus, yet the operator's foothold survived. The malware had abused the Background Intelligent Transfer Service: a self-contained BITS job with a SetNotifyCmdLine notification command re-downloads a payload and re-launches it with regsvr32 every time a transfer completes, then deletes its tracks, leaving only the job entry inside the service state database. Reconstruct the persistence loop from BITS-Client operational events, Sysmon process lineage, and endpoint XDR telemetry, prove it outlived the file-based cleanup, and classify the key ATT&CK techniques.