DNS Tunneling: Covert Exfiltration from One Host
A single workstation at Valkara Analytics has been leaking data all day through a DNS tunnel. Every query carries encoded payload chunks inside high-entropy subdomain labels to an attacker-controlled name server. Reconstruct the tunnel from resolver and firewall logs, identify the compromised host and the attacker's infrastructure, and map the technique to ATT&CK.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Identify the anomalous host
10Something on the internal network has been hammering the DNS resolver all day at a rate far outside normal. Before anything else, determine which workstation is responsible.
Name the tunnel domain
15The anomalous host is not querying normal destinations. Identify the external domain that is receiving all of its unusual DNS requests.
Find the attacker's name server
15The resolver is forwarding all of these unusual queries somewhere. Identify the external IP that is acting as the authoritative name server for the tunnel domain.
Explain the anomalous query type
15The tunneling tool is using an unusual DNS record type to carry data in both directions. Identify which query type dominates the anomalous session.
Map the primary technique
20The activity you have been tracing is a well-documented adversary technique. Map the observed behavior to its ATT&CK sub-technique identifier.
Count the daily tunnel queries
15Establish the scale of the exfiltration. The resolver's end-of-day summary captures exactly how many queries left the network through the tunnel today.
6 tasks · 90 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allOpen SMB Share: Unauthorized Data Access
A finance file share on an internal Windows server was misconfigured to allow all domain users read access. A workstation account with no finance role connected over SMB and bulk-read payroll records, M&A strategy documents, and board materials. Reconstruct the session from Windows Security audit events and internal firewall logs.
Scheduled Task Persistence: Recurring Beacon on a Host
A dropper disguised as a license-activation tool runs on a financial-sector workstation and registers a Windows Scheduled Task to re-execute a PowerShell stager every 15 minutes. Each firing beacons over HTTPS to an attacker-controlled domain. Investigate the event log, XDR process tree, and proxy records to trace the persistence chain from dropper to C2.
VPN Brute Force: Credential Attack on the Remote-Access Portal
A password-spray campaign targets the Halcyon Freight SSL-VPN portal from two rotating source IPs, submitting credentials across many accounts to stay under per-account lockout thresholds. One account eventually matches. Reconstruct the spray, identify the compromised account and the operator IP that opened the active session, and trace the first move the attacker made over the tunnel.