Operation Lunar Peek: PAN-OS Mgmt Interface Takeover
An internet-exposed PAN-OS firewall management interface was taken over in a single night. An unauthenticated attacker bypassed authentication on the management web interface to gain PAN-OS administrator privileges, chained an authenticated command injection to run commands as root, created a rogue administrator for persistence, and wrote a PHP web shell under the appliance web root that a separate host returned to drive interactively. Reconstruct the full management-plane chain from the firewall and SIEM telemetry and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Find where the firewall was reachable from the internet
30The whole intrusion was only possible because one interface should never have faced the internet. Identify the external source that first probed it.
Catch the authentication bypass
30An administrator session appeared that no credential earned. Classify how the attacker first got in.
Identify the host that ran the exploit chain
35One external host did the heavy lifting: the bypass, the escalation, and what it left behind. Identify it.
Find the persistence account
35The operator made sure a password reset would not lock them out. Identify what they added to the appliance.
Recover the web shell indicator
35The operator left a small script behind for interactive control. Provide the huntable file indicator for it.
Separate the operator who returned to use the web shell
35Exploitation and use came from different hosts. Identify the source that drove the web shell after it was planted.
Classify the implant the operator left behind
30Name the persistence mechanism that gave the operator interactive command execution on the appliance.
8 tasks · 230 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with Firewall concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allHermeticWiper: Signed-Driver Destruction on the Eve of Invasion
A destructive, worm-assisted wiper operation run from inside an already-compromised Active Directory estate. An operator holding domain-administrator access pushed a binary signed to a code-signing identity to hosts over SMB, ran it as a service, and let it drop and load a legitimately signed EaseUS partition driver to reach the raw disk, overwrite the Master Boot Record, and shred the NTFS Master File Table. The crash-dump facility was disabled to slow forensics, a companion worm re-deployed the payload over SMB and WMI, and a decoy ransom note was dropped to misdirect responders. Reconstruct the destruction chain from SIEM, endpoint XDR, and firewall telemetry, and classify the key ATT&CK techniques.
TRITON: Safety System Sabotage at a Petrochemical Plant
A nation-state-grade ICS intrusion that reaches the deepest protective layer of a petrochemical plant. An attacker reuses remote access to pivot from the DCS network onto a dual-homed Schneider Triconex SIS engineering workstation, transfers the TRITON attack framework (an executable masquerading as the legitimate Triconex Trilog viewer plus a bundled library and two controller payloads), and uses the proprietary TriStation protocol to reprogram a safety controller, until a failed validation check trips an unplanned emergency shutdown. Reconstruct the kill chain from SIEM, endpoint XDR, and firewall telemetry, and classify the ICS impact techniques.
Midnight Blizzard: Malicious Entra App Registration and Service Principal Abuse
A nation-state-style identity-plane intrusion that lives entirely in Microsoft Entra ID and Exchange Online. A low-and-slow password spray across rotating residential-proxy IPs lands on a legacy, no-MFA test account; from there the actor pivots into the application layer, creates a rogue user, registers a new malicious application and service principal, grants it the Office 365 Exchange Online full_access_as_app role plus EWS.AccessAsUser.All, adds a client secret for durable app-only access, and reads corporate mailboxes over Exchange Web Services with no user sign-in. Work the Entra sign-in audit, the application and service-principal lifecycle and role-assignment events, the credential change, and the EWS mailbox operations to reconstruct the chain and classify the key ATT&CK techniques.