Storm-2949: Azure VM Run Command, VMAccess Backdoor, and Key Vault Secret Dump
A hands-on-keyboard intrusion that turned one compromised cloud identity into control over an entire Azure estate. After seizing a finance user's account through self-service password reset abuse and attacker-owned MFA, the operator enumerated the tenant, escalated with an RBAC role assignment, harvested App Service publishing profiles, rewrote a Key Vault access policy and dumped every secret in four minutes, stole storage keys, and finished on a production VM using the VMAccess extension to mint a backdoor admin and Run Command to disable Defender and install ScreenConnect. Reconstruct the kill chain from the Azure cloud audit trail and the VM's endpoint XDR telemetry, and classify the key ATT&CK techniques.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Incident brief
0Orient yourself before pivoting into the data. This is a no-answer briefing checkpoint.
Identify the compromised identity
30Every later action runs through one cloud account that was seized in the first hour. Identify the account the operator took over.
Classify the persistence on the identity
30The operator made sure that resetting the password again would not lock them out. Classify the ATT&CK technique for how they kept hold of the account.
Find the secret store that was emptied
35The operator granted themselves access to a secret store and then read all of it within minutes. Identify the resource they dumped.
Classify the secret-dump technique
30Name precisely how the operator harvested those credentials. Classify the credential-access technique for the bulk secret read.
Recover the backdoor administrator
35On the final night the operator minted an on-host admin account from the control plane. Identify the account that was created on the VM.
Classify the on-VM execution method
30The operator ran code on the VM without any inbound connection. Classify the ATT&CK technique for how PowerShell was executed on the host.
Recover the RMM persistence indicator
35Pin down the file-level indicator for the remote-management tool the operator installed so it can be hunted. Provide the SHA-256 of the installer.
Isolate the RMM relay
35The persistence channel uses different infrastructure than the control-plane abuse. Identify the external IP the backdoored VM beacons to.
9 tasks · 260 points total
Training Tools
Cloud Console
Cloud infrastructure logs
XDR Console
Endpoint detection & response
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with Cloud concepts
- Familiarity with XDR concepts
Ready to investigate?
More Operations
View allOneClik: ClickOnce + AppDomainManager Injection with ETW Patching and AWS-Hidden C2
A ClickOnce-delivered intrusion at an oil-and-gas operator that mirrors nation-state tradecraft. A spearphishing link served a Microsoft ClickOnce deployment that ran under the trusted dfsvc.exe, sideloaded a signed binary whose tampered .config used .NET AppDomainManager hijacking to load an attacker assembly at CLR startup, patched Event Tracing for Windows to blind the sensor, ran anti-debugging checks, and injected a Golang backdoor (RunnerBeacon) that hid its C2 behind AWS CloudFront and API Gateway. Reconstruct the chain from email, endpoint XDR, and cloud audit telemetry, and classify the key ATT&CK techniques.
Org2Org: Scattered Spider's Okta Impersonation
A help-desk social-engineering intrusion that abused Okta's inbound federation (Org2Org) to impersonate users across tenants. An operator phoned the IT service desk to reset a Super Administrator's MFA factors, re-enrolled the factor from an anonymizing proxy, and signed in to the Okta Admin Console as Super Admin. They granted Super Administrator to a second account for persistence, then stood up a second, attacker-controlled Identity Provider as an inbound-federation source and manipulated its username parameter to log in as real users with no victim password or MFA. Work the SIEM service-desk trail and the Okta System Log to reconstruct the chain and classify the trusted-relationship abuse.
FortiJump: FortiManager Zero-Day Config Heist
A FortiManager appliance is breached through an FGFM authentication bypass (the FortiJump zero-day): an attacker-controlled FortiManager registers itself as a trusted device, stages every managed FortiGate's configuration into a single hidden archive on the appliance, and exfiltrates it over HTTPS, stealing the fleet inventory and FortiOS256-hashed administrator passwords. Weeks later the operator re-registers and exfiltrates again to fresh infrastructure. With no malware on any firewall and no endpoint to inspect, reconstruct the entire heist from the appliance event log and perimeter firewall alone.