Trust, Forged: The Monitoring-Platform Backdoor
A trusted, signed plugin in Greyford's network monitoring platform was backdoored upstream. From a silent defense-tamper on the monitoring server, follow a low-and-slow DGA-over-DNS beacon under a single attacker apex, a CNAME redirect to a staged C2, and finally the theft of on-prem token-signing trust that forges SAML tokens into anomalous, MFA-less cloud sign-ins. The DNS resolver log is your sharpest blade.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Catch the silent tamper
35The monitoring server is supposed to be one of the most trustworthy boxes in the estate. Overnight it stopped behaving like one. Before any traffic left, something on the host quietly weakened its own defenses. Identify the protective service that was switched off.
Find the beacon hiding in DNS
40Right after the host weakened its defenses, it started resolving names no legitimate process should invent. The pattern is the tell. Identify the single external apex domain under which the monitoring server was resolving algorithmically-generated subdomains.
Follow the redirect
40The DNS beacon was not the destination, it was a switchboard. For this host, one query came back with an answer that handed it somewhere new. Identify the second-stage domain the DNS answer redirected the host to.
Confirm the live channel
35Once redirected, the host stopped whispering through DNS and opened a real conversation. Identify the external address the monitoring server connected to over HTTPS for its command-and-control channel.
Trace the trust being forged
40The intrusion did not stop at the monitoring server. It reached for the keys that let the organization vouch for who its users are. Identify the on-prem server whose token-signing material was accessed to forge authentication tokens.
Spot the impossible sign-in
35With forged tokens in hand, the actor walked into the cloud as a trusted user. No password failed, no MFA fired. Identify the external address behind the first anomalous cloud sign-in produced by a forged token.
Classify the initial access
30For the incident report, classify how the actor first got in by mapping it to MITRE ATT&CK. Identify the technique that describes compromising a trusted software supply chain to deliver the implant.
7 tasks · 255 points total
Training Tools
SIEM Console
Log analysis & SPL queries
Firewall Console
Network traffic analysis
Cloud Console
Cloud infrastructure logs
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
- Familiarity with Cloud concepts
Ready to investigate?
More Operations
View all3CX Cascading Supply-Chain Compromise
A signed, trusted desktop softphone starts behaving like malware after a routine update: it side-loads an invalidly-signed DLL, pulls a hidden payload from icon files, beacons out over HTTPS with a fixed cookie, steals browser credentials, and stages service persistence on the build host. There is no obviously-bad executable to flag, the detection is the anomalous behaviour of a trusted application. Work the endpoint image-loads and process tree, the SIEM DNS and network records, and the perimeter egress to reconstruct the intrusion.
Volt Typhoon: living-off-the-land in critical infrastructure
No malware, no ransomware, no payload to scan for, just native Windows binaries used in an abnormal sequence and a stolen administrator credential. A stealth operator plants a tiny web shell on a water utility's internet-facing host, dumps LSASS with a signed system DLL, routes C2 through a compromised home router, and exports the entire Active Directory database off the domain controller before clearing the logs. Work the Windows Security log, the endpoint process tree, and the perimeter traffic to separate the living-off-the-land activity from a heavy baseline of legitimate admin work.
Medusa RaaS: VPN access to enterprise encryption
A regional healthcare provider is breached through its internet-facing SSL-VPN, and within a shift a Medusa affiliate harvests domain credentials, pivots to the domain controller and backup servers, persists with a rogue remote-management agent hidden among the estate's legitimate ones, steals patient data to cloud storage, and deploys ransomware. Work the VPN authentication records, the endpoint process tree, and the perimeter traffic to reconstruct the intrusion end to end and tell the abuse apart from a heavy baseline of normal remote-management activity.