Path Traversal to NTDS: Check Point Quantum VPN Leak
An internet-facing Check Point Quantum security gateway is exploited through CVE-2024-24919, an unauthenticated path-traversal arbitrary file read. The attacker reads the appliance password-hash file and a VPN/LDAP configuration file, recovers the gateway's Active Directory bind credential, cracks it offline, then logs back in over the VPN as that account and extracts the Active Directory database from a volume-shadow copy on the domain controller. No malware touches the gateway. Reconstruct the kill chain from Check Point portal and VPN logs, Windows telemetry, and the perimeter firewall, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find the exploit source
40The whole intrusion starts with unauthenticated requests that read files off the gateway. Identify the internet address that ran the file-read exploit.
Classify the initial-access technique
35Name how the attacker got their first foothold. Classify the MITRE ATT&CK technique for the way initial access was achieved against the gateway.
Recover the leaked credential
40The file read handed the attacker an account they later abused. Identify the account whose credential was exposed off the appliance.
Catch the credential reuse
40Hours after the leak the attacker came back through the front door. Identify the internet address that logged in over the VPN with the stolen account.
Classify the directory-theft technique
35On the domain controller the attacker copied the crown jewels. Classify the MITRE ATT&CK sub-technique for how the directory database was stolen.
Recover the staged-database indicator
35Pin down the file-level indicator for the stolen directory database so it can be hunted. Provide the SHA-256 of the staged Active Directory database.
7 tasks · 225 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Firewall concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allTrigona Ransomware: Rclone-to-MEGA Cloud Exfiltration
A fast, RDP-only, hands-on-keyboard intrusion that went from a valid Administrator logon on an exposed RDP gateway to estate-wide Trigona ransomware in under three hours. The actor dropped a batch-script and Netscan toolkit, enumerated the network and file shares, pivoted over RDP, disabled Windows Defender by hand, exfiltrated file shares to MEGA cloud storage with a renamed rclone client, then staged and ran the Trigona encryptor over SMB. Reconstruct the full kill chain from SIEM, endpoint XDR, and perimeter firewall telemetry, and classify the key ATT&CK techniques.
GoldDigger: Accessibility-Abusing Banker Draining APAC Accounts
A mobile-first banking-trojan intrusion on a corporate bring-your-own-device fleet. An employee searching for a government portal sideloaded a trojanized Android installer carrying the GoldDigger banker, granted it Accessibility Service, and the trojan then keylogged, painted fake bank-login overlays, intercepted SMS one-time-passcodes, and beaconed stolen data to a cluster of attacker command-and-control domains, enabling account-draining fraud. Reconstruct the kill chain from the mobile egress SIEM, the mobile threat-defense sensor, and the perimeter firewall, and classify the key ATT&CK mobile techniques.
Consent Granted: Malicious OAuth App Mailbox BEC
A consent-phishing intrusion where an adversary-in-the-middle proxy steals a finance analyst's Microsoft 365 session, then the attacker tricks her into granting a malicious multitenant OAuth application delegated mailbox permissions. The app gets its own client secret for durable access, reads her mailbox over Microsoft Graph, hides vendor replies with an inbox rule, and sends a fraudulent bank-detail-change reply into a live settlement thread. Work the Entra consent and permission-grant audit, the service-principal credential change, the Graph mailbox operations, and the email evidence to reconstruct the chain.