Removable Media: USB Autorun Malware on a Workstation
A USB drive plugged into a Kaldera Systems workstation auto-ran a malicious shortcut that executed a VBScript dropper, planted a persistence Run key, and began beaconing to an external C2 host. Single-host endpoint triage using XDR process-tree and SIEM Sysmon logs.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Identify the infected workstation
10A USB drive was plugged into one of the organization's workstations and something started happening shortly after. Before digging into what was dropped, find the internal hostname of the workstation where the infection originated.
Name the user who executed the malicious file
10The USB shortcut was opened by a logged-in user. Determine which domain account was running at the time wscript.exe was invoked from the LNK.
Find the persistence mechanism
15After dropping the payload, the malware made sure it would survive a reboot. Identify the full registry key path used to establish persistence.
Identify the dropped payload
15The VBScript dropper copied a malicious binary onto the workstation. Name the file it dropped.
Find the C2 domain
15After launching, the payload immediately tried to call home. Identify the external domain it connected to.
Map the persistence to ATT&CK
15The malware used a specific technique to ensure it runs every time the user logs in. Identify the MITRE ATT&CK sub-technique ID that describes this persistence method.
6 tasks · 80 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with XDR concepts
- Familiarity with SIEM concepts
Ready to investigate?
More Operations
View allPowerShell Download Cradle: Encoded Payload on a Workstation
A finance workstation runs an obfuscated PowerShell command with a base64-encoded download cradle that fetches and executes a second-stage payload, which then beacons out to a C2 host. Work through the Sysmon and Windows Security event logs alongside the XDR process tree to trace the encoded launch, the staging fetch, the dropped file, and the recurring beacon.
Fake Browser Update to Atomic macOS Stealer
A freelance designer's personal Mac is lured by a ClearFake 'your browser is out of date' prompt into downloading a fake Safari update. The bundled app is Atomic macOS Stealer: it phishes the login password, raids the keychain and browser stores, and uploads the loot to a single host over the same channel it uses to communicate. Reconstruct the chain from the macOS endpoint telemetry and the web filter.
UNC6384: Captive-Portal PlugX Implant
A diplomat's managed laptop on an untrusted conference network has its captive-portal check hijacked and is steered to a page posing as a security update. The download is a signed Canon utility paired with a malicious DLL: running the trusted binary side-loads the DLL, which runs PlugX in memory, beacons to a single HTTPS host, and sets a Run key. Reconstruct the chain from the proxy, Sysmon, endpoint, and firewall evidence.