The Agent Who Saw Too Much
A self-registered 'football agent' read live match data, downloaded internal documents, and pulled broadcast RTMP stream keys — all without a single assigned role. The frontend said Access Denied; the backend served everything. Reconstruct the broken-authorization chain across Entra sign-ins, web/API logs, cloud audit, and the perimeter firewall.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Trace the unauthorized entry
15Overnight, internal match data and documents that should sit behind an assigned agent role left the platform — pulled by an account created only hours earlier. Establish where it began.
Attribute the activity
15Many agents registered and browsed normally that day. Exactly one account read data it was never authorized to see. Attribute the unauthorized access to a single principal.
Locate the authorization failure
20The portal's interface refused the account, yet the data still left the platform. Determine which backend service trusted the request the front end had already rejected.
Follow the documents
20Beyond match data, internal spreadsheets were exfiltrated. They were not reached directly — something handed the account the links. Find what issued them.
Assess the blast radius
20One downloaded file was not a document but a set of live-broadcast credentials. Determine what they unlock.
Classify the root cause
15Summarize the intrusion for the report: a legitimately provisioned cloud account was trusted by a backend that never authorized it. Map the root cause to its MITRE ATT&CK technique.
6 tasks · 105 points total
Training Tools
SIEM Console
Log analysis & SPL queries
Cloud Console
Cloud infrastructure logs
Firewall Console
Network traffic analysis
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with SIEM concepts
- Familiarity with Cloud concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allEdge Device Exploitation: VPN Zero-Day
Investigate a breach targeting exposed edge security appliances. In this scenario, an attacker exploits Ivanti Connect Secure CVE-2025-22457 to obtain unauthenticated code execution, spawns a shell from the gateway web process, retrieves a Linux payload, and attempts to preserve access using edge-device service abuse patterns similar to FortiGate SSL-VPN post-exploitation tradecraft. Analyze SIEM, XDR, and firewall evidence to identify the spawned shell, suspicious domain, local sync script, and defensive block policy.
Frozen Assets: The Snowflake Tenant Heist
A retailer's Snowflake tenant is accessed with a contractor credential lifted from an infostealer log. With no MFA and no network policy to stop it, the actor logs in from VPN-exit IPs, recons with anomalous tooling, and bulk-exfiltrates an entire customer table. Work the Snowflake audit trail to reconstruct the theft.
Zerologon DC takeover → ransomware
An unprivileged phishing foothold becomes a domain-wide ransomware outbreak in hours. The attacker abuses the Zerologon flaw to reset a domain controller's machine-account password, pivots controller-to-controller, and encrypts the estate after gutting the backups. Work the Windows Security log, the endpoint process tree, and the perimeter traffic to reconstruct the takeover.