HermeticWiper: Signed-Driver Destruction on the Eve of Invasion
A destructive, worm-assisted wiper operation run from inside an already-compromised Active Directory estate. An operator holding domain-administrator access pushed a binary signed to a code-signing identity to hosts over SMB, ran it as a service, and let it drop and load a legitimately signed EaseUS partition driver to reach the raw disk, overwrite the Master Boot Record, and shred the NTFS Master File Table. The crash-dump facility was disabled to slow forensics, a companion worm re-deployed the payload over SMB and WMI, and a decoy ransom note was dropped to misdirect responders. Reconstruct the destruction chain from SIEM, endpoint XDR, and firewall telemetry, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Recover the destructive payload's file indicator
35Every wiped host received the same binary. Provide the huntable file indicator for the destructive payload so it can be swept from the estate.
Name the abused signing identity
30The payload looked trustworthy because of who signed it. Provide the code-signing identity the destructive binary was signed to.
Classify the raw-disk privilege abuse
30The payload could not reach the raw disk on its own. Classify the ATT&CK technique for how it gained that access.
Establish the operator's push account and source
35The destruction was driven by one privileged account from one host. Identify the account that pushed the payload across the estate.
Pin down the worm's first re-deployment target
35One host was not pushed by the operator directly but reached by a self-spreading component. Identify the host the worm wiped.
Classify the destruction technique
30Name precisely what the payload did to render the machines unbootable. Classify the impact technique.
Expose the misdirection artifact
35The operator tried to make destruction look like ransomware. Provide the SHA-1 of the decoy binary dropped to mislead responders.
8 tasks · 230 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with XDR concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allStorm-0501: Azure Storage Account Key Abuse and Cloud Ransom
A cloud-native ransomware operation against a hybrid Microsoft Entra ID tenant, delivered entirely through the Azure control plane with no encryptor binary. A synced non-human identity holding Global Administrator without MFA is reused to sign in, a federated-domain SAML backdoor is planted, the operator elevates to Owner over every subscription, lists the storage account keys, exfiltrates the freight archive with AzCopy, deletes snapshots, restore points and the Recovery Services vault, then re-encrypts the surviving storage with a customer-managed key in an attacker key vault and extorts over Teams. Reconstruct the chain from the Azure Activity Log, storage diagnostics, and Entra sign-in telemetry, classifying the key-theft and encryption-for-impact techniques.
Operation Lunar Peek: PAN-OS Mgmt Interface Takeover
An internet-exposed PAN-OS firewall management interface was taken over in a single night. An unauthenticated attacker bypassed authentication on the management web interface to gain PAN-OS administrator privileges, chained an authenticated command injection to run commands as root, created a rogue administrator for persistence, and wrote a PHP web shell under the appliance web root that a separate host returned to drive interactively. Reconstruct the full management-plane chain from the firewall and SIEM telemetry and classify the key ATT&CK techniques.
TRITON: Safety System Sabotage at a Petrochemical Plant
A nation-state-grade ICS intrusion that reaches the deepest protective layer of a petrochemical plant. An attacker reuses remote access to pivot from the DCS network onto a dual-homed Schneider Triconex SIS engineering workstation, transfers the TRITON attack framework (an executable masquerading as the legitimate Triconex Trilog viewer plus a bundled library and two controller payloads), and uses the proprietary TriStation protocol to reprogram a safety controller, until a failed validation check trips an unplanned emergency shutdown. Reconstruct the kill chain from SIEM, endpoint XDR, and firewall telemetry, and classify the ICS impact techniques.