One Packet From Disaster: SSRF to IMDS to S3
A misconfigured WAF in front of a bank's card-application portal was tricked into asking the cloud for its own keys. Follow the request from the web tier into the metadata service, watch an over-privileged role's credentials walk out the door, and reconstruct the 30 GB customer-data theft across CloudTrail, the perimeter, and the WAF logs.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find where the customer data walked out
15Roughly 30 GB of customer card-application records left the cloud account overnight. Working the cloud audit trail, identify the S3 bucket that took the heaviest unauthorized read activity.
Trace the request that started it
15The credentials behind the theft were never phished or brute-forced, they were handed out by an internal service after a single crafted web request. Identify the host that was coerced into fetching an internal address on the attacker's behalf.
Pin the external operator
20Legitimate use of the compromised cloud role only ever comes from one place. Find the external address that used that role's session from outside the environment.
Name the over-trusted identity
15The breach hinged on one identity holding far more access than its job required. Identify the cloud role whose temporary credentials were stolen and abused.
Classify the credential source
15Map the technique that let the attacker obtain cloud credentials without a password, a key, or malware, purely by reaching a service every instance can talk to.
5 tasks · 80 points total
Training Tools
Cloud Console
Cloud infrastructure logs
Firewall Console
Network traffic analysis
SIEM Console
Log analysis & SPL queries
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Cloud concepts
- Familiarity with Firewall concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allZerologon DC takeover → ransomware
An unprivileged phishing foothold becomes a domain-wide ransomware outbreak in hours. The attacker abuses the Zerologon flaw to reset a domain controller's machine-account password, pivots controller-to-controller, and encrypts the estate after gutting the backups. Work the Windows Security log, the endpoint process tree, and the perimeter traffic to reconstruct the takeover.
Exchange ProxyShell: Domain-Wide Ransomware
An internet-facing Exchange server falls to ProxyShell, dropping ASPX web shells that run as SYSTEM. The attacker re-enables a built-in account, dumps LSASS with a Windows DLL, tunnels out with Plink and FRP, moves laterally over RDP, and encrypts the domain with its own BitLocker and DiskCryptor, no ransomware binary in sight. Work the Exchange logs, the endpoint process tree, and the perimeter traffic to reconstruct the intrusion.
Hide Your RDP
An internet-facing RDP server at a logistics firm is password-sprayed into, and within hours a RansomHub affiliate dumps credentials, pivots to the domain controller and backup servers, steals finance data over SFTP, and deploys ransomware. Work the authentication records, the endpoint process tree, and the perimeter traffic to reconstruct the intrusion end to end.