PowerShell Download Cradle: Encoded Payload on a Workstation
A finance workstation runs an obfuscated PowerShell command with a base64-encoded download cradle that fetches and executes a second-stage payload, which then beacons out to a C2 host. Work through the Sysmon and Windows Security event logs alongside the XDR process tree to trace the encoded launch, the staging fetch, the dropped file, and the recurring beacon.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Spot the suspicious PowerShell launch
15The endpoint agent flagged unusual activity on a finance workstation this morning. Start by identifying exactly how PowerShell was invoked -- the specific flags that made this launch different from a legitimate administrative script.
Identify the parent process
15PowerShell did not launch itself. Trace the process that spawned it -- because the parent reveals how the attacker got their first foothold on the machine.
Trace the staging server
20The encoded command is a download cradle -- it fetches and immediately executes a remote script. Determine the IP address of the staging server that provided the second-stage payload.
Name the dropped payload
15The download cradle wrote a file to disk and executed it. Identify the filename of that second-stage executable.
Find the C2 beacon destination
20Once the payload was running, it began calling home. Determine the domain it used for its recurring beacon.
Classify the obfuscation technique
15The entire attack chain relied on encoding the initial command to hide its intent. Map that obfuscation approach to its MITRE ATT&CK technique ID.
6 tasks · 100 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allVPN Brute Force: Credential Attack on the Remote-Access Portal
A password-spray campaign targets the Halcyon Freight SSL-VPN portal from two rotating source IPs, submitting credentials across many accounts to stay under per-account lockout thresholds. One account eventually matches. Reconstruct the spray, identify the compromised account and the operator IP that opened the active session, and trace the first move the attacker made over the tunnel.
Removable Media: USB Autorun Malware on a Workstation
A USB drive plugged into a Kaldera Systems workstation auto-ran a malicious shortcut that executed a VBScript dropper, planted a persistence Run key, and began beaconing to an external C2 host. Single-host endpoint triage using XDR process-tree and SIEM Sysmon logs.
Fake Browser Update to Atomic macOS Stealer
A freelance designer's personal Mac is lured by a ClearFake 'your browser is out of date' prompt into downloading a fake Safari update. The bundled app is Atomic macOS Stealer: it phishes the login password, raids the keychain and browser stores, and uploads the loot to a single host over the same channel it uses to communicate. Reconstruct the chain from the macOS endpoint telemetry and the web filter.