Scheduled Task Persistence: Recurring Beacon on a Host
A dropper disguised as a license-activation tool runs on a financial-sector workstation and registers a Windows Scheduled Task to re-execute a PowerShell stager every 15 minutes. Each firing beacons over HTTPS to an attacker-controlled domain. Investigate the event log, XDR process tree, and proxy records to trace the persistence chain from dropper to C2.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the persistence footprint
15A workstation raised multiple alerts overnight. Before anything else, establish that something new and persistent was installed and identify the mechanism the attacker used to ensure re-execution after each reboot.
Identify the parent process
15The persistence mechanism did not appear on its own. Something ran first and installed it. Trace that initial execution back to its source and name the file responsible.
Locate the stager on disk
20The dropper did not just register a task. It also wrote a file that the task will execute on each firing. Find the full path of the script that serves as the recurring execution payload.
Map the C2 endpoint
15Once the task fires, the stager immediately reaches out. Identify the domain it contacts and confirm the cadence of connections to assess the scope of the compromise.
Classify the persistence technique
10The dropper used a specific, documented method to ensure its payload re-runs on a schedule. Map that technique to its MITRE ATT&CK identifier.
5 tasks · 75 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allDNS Tunneling: Covert Exfiltration from One Host
A single workstation at Valkara Analytics has been leaking data all day through a DNS tunnel. Every query carries encoded payload chunks inside high-entropy subdomain labels to an attacker-controlled name server. Reconstruct the tunnel from resolver and firewall logs, identify the compromised host and the attacker's infrastructure, and map the technique to ATT&CK.
VPN Brute Force: Credential Attack on the Remote-Access Portal
A password-spray campaign targets the Halcyon Freight SSL-VPN portal from two rotating source IPs, submitting credentials across many accounts to stay under per-account lockout thresholds. One account eventually matches. Reconstruct the spray, identify the compromised account and the operator IP that opened the active session, and trace the first move the attacker made over the tunnel.
PowerShell Download Cradle: Encoded Payload on a Workstation
A finance workstation runs an obfuscated PowerShell command with a base64-encoded download cradle that fetches and executes a second-stage payload, which then beacons out to a C2 host. Work through the Sysmon and Windows Security event logs alongside the XDR process tree to trace the encoded launch, the staging fetch, the dropped file, and the recurring beacon.