Open SMB Share: Unauthorized Data Access
A finance file share on an internal Windows server was misconfigured to allow all domain users read access. A workstation account with no finance role connected over SMB and bulk-read payroll records, M&A strategy documents, and board materials. Reconstruct the session from Windows Security audit events and internal firewall logs.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Locate the share connection
10An alert fired on unusual SMB traffic from a workstation to the file server during business hours. Start by establishing which account connected to the file server and which share it accessed.
Identify the accessing account
15Now that the share is known, identify who made the unauthorized connection. The answer is a domain account that has no role in finance or HR.
Trace the workstation source
15Correlate the SIEM event with the firewall to determine which workstation initiated the SMB connection to the file server.
Count the sensitive files accessed
10Event 5145 records each individual file access within a share. Determine how many distinct sensitive files were read by the unauthorized account during the session.
Identify the misconfigured permission
15The root cause of this incident is a share permission that should never have been granted. Identify the overly broad Windows built-in group that was assigned read access to the sensitive share.
Map the collection technique
15Classify the data-gathering activity using the MITRE ATT&CK framework. Identify the technique that describes an adversary reading data from accessible network file shares.
6 tasks · 80 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allRDP Brute Force: Internet-Facing Server Login
An internet-exposed Windows Server running RDP has been receiving a sustained brute-force campaign from an external address. After dozens of failed authentication events, one attempt succeeds and an interactive session is opened. Reconstruct the attack from the Windows Security event log, identify the source and target, and classify the technique.
DNS Tunneling: Covert Exfiltration from One Host
A single workstation at Valkara Analytics has been leaking data all day through a DNS tunnel. Every query carries encoded payload chunks inside high-entropy subdomain labels to an attacker-controlled name server. Reconstruct the tunnel from resolver and firewall logs, identify the compromised host and the attacker's infrastructure, and map the technique to ATT&CK.
Scheduled Task Persistence: Recurring Beacon on a Host
A dropper disguised as a license-activation tool runs on a financial-sector workstation and registers a Windows Scheduled Task to re-execute a PowerShell stager every 15 minutes. Each firing beacons over HTTPS to an attacker-controlled domain. Investigate the event log, XDR process tree, and proxy records to trace the persistence chain from dropper to C2.