Brixton Foods: the directory answered a request it should have refused
A food manufacturer's help desk raised a ticket at lunchtime: an overnight production report had not written to the file share, and one workstation had been slow all morning. By the evening the share was unreadable and an administrator account nobody on the IT rota recognises had been busy on the domain controllers. You have the day's Windows Security feed and the endpoint telemetry for the estate. Reconstruct what the operator did between the first mailbox and the unreadable share, and name the accounts and hosts the response team has to act on.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the foothold
50One workstation showed activity this morning that ran ahead of anything on the servers. Work the endpoint process records and identify the workstation where the intrusion began.
Identify the controller that was replicated
55The directory itself was asked to replicate during the intrusion. Determine which domain controller served that request.
Attribute the replication request
55The replication request you traced was made under a specific account. Read the account name off the directory object-access record so it can be disabled and its sessions revoked.
Recover the credential-access precursor
60Before the directory was touched, something on the foothold read credential material out of memory. Identify the tool that opened the credential process so its hash can be pushed to the rest of the fleet.
Classify the directory-replication technique
55Summarize for the incident report how the operator pulled domain credentials without cracking a single password. Map the core credential-theft step to its MITRE ATT&CK technique.
5 tasks · 275 points total
Training Tools
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allPetitPotam: NTLM Relay to AD CS Domain Takeover
An internal workstation coerces a domain controller into authenticating to it, relays that authentication to the AD CS Web Enrollment endpoint, and walks away with a certificate for the domain controller itself. The operator turns that certificate into a domain-controller identity and DCSyncs the entire domain. Work the coercion traffic, the certificate issuance records, and the endpoint telemetry to reconstruct an attack that never fired a single exploit.
Phishing foothold → domain compromise
A finance user at Vendt Aerospace opened a mail attachment mid-morning, and within the hour an administrative account was signing in to a server it had no business reaching. Work the domain controller's authentication records and the endpoint process telemetry, separate the intrusion from an estate that produces plenty of traffic that looks similar, and reconstruct how the operator got from one workstation to the directory.
AD CS ESC1: Certificate Template Abuse to Domain Admin
An ordinary user becomes a Domain Admin without stealing a password. A misconfigured certificate template lets the enrollee supply the subject, so the user requests a certificate whose Subject Alternative Name names a Domain Admin, and the CA issues it. The forged certificate is then used for PKINIT to authenticate as that admin. Work the certificate-authority records, the endpoint process tree, and the domain controller's Kerberos logs to reconstruct the escalation.