The Half-Second Tell
A Linux hosting fleet quietly picks up an affected xz-utils / liblzma 5.6.1 build, and the SSH daemon's login path is no longer its own. There is no crash and no malware drop, only a shared object whose hash moved, an sshd that forks a shell it never should, a half-second of extra login latency, and a root key the fleet never issued. Work the package, file-integrity, auth, and perimeter records to surface the subtle host artifacts of CVE-2024-3094 and scope the affected version.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the host that fooled the latency probe
45Overnight, synthetic monitoring on the hosting fleet flagged an SSH login that took far longer than it should have. Work the host telemetry and identify the edge node whose login latency first broke the threshold.
Catch the SSH daemon doing something it never should
60A slow login is a symptom, not a cause. On that same node, pivot into the process-execution records and find the moment the SSH daemon behaved in a way a healthy sshd never does.
Identify the file behind the tampered login path
60The SSH daemon's behavior changed without anyone editing sshd itself. Find the on-disk object whose integrity changed underneath it.
Pin the affected version
55For the fleet-wide remediation ticket, leadership needs the exact version that has to be ripped out. Determine the affected liblzma/xz version that landed on the hosts.
Trace how the package reached the fleet
50The edge nodes did not each fetch this from the internet, it came from inside. Identify the host the affected package was built and staged on before it rolled to the fleet.
Identify the unprovisioned login
60The tampered authentication path was not theoretical, someone used it. Find the external address that completed a root login the fleet never authorized.
Confirm the exposure on the perimeter
45Corroborate that external session at the network edge. Confirm the operator's traffic reached the affected node through the firewall and name the rule that let it in.
Classify the root cause
40Close the incident report by mapping the root cause to MITRE ATT&CK. Identify the technique that describes how the affected library was delivered into the environment in the first place.
8 tasks · 415 points total
Training Tools
Skills You'll Build
Complex multi-stage investigations. Realistic noise, ambiguous indicators, lateral movement.
Prerequisites
- Basic understanding of security alerts
- Experience with log analysis tools
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allScattered Spider: Identity-First Attack Chain
Investigate a high-sophistication intrusion by UNC3944 (Scattered Spider). This scenario simulates a multi-stage attack starting from social engineering and MFA fatigue, progressing through the exploitation of unmanaged edge devices, and culminating in a 'Bring Your Own Vulnerable Driver' (BYOVD) technique to blind kernel-level security agents. Analysts must correlate identity providers, cloud sign-ins, and deep endpoint forensics to reconstruct the timeline and identify the breakout speed of this financially motivated threat actor.
3CX Cascading Supply-Chain Compromise
A signed, trusted desktop softphone starts behaving like malware after a routine update: it side-loads an invalidly-signed DLL, pulls a hidden payload from icon files, beacons out over HTTPS with a fixed cookie, steals browser credentials, and stages service persistence on the build host. There is no obviously-bad executable to flag, the detection is the anomalous behaviour of a trusted application. Work the endpoint image-loads and process tree, the SIEM DNS and network records, and the perimeter egress to reconstruct the intrusion.
Trust, Forged: The Monitoring-Platform Backdoor
A trusted, signed plugin in Greyford's network monitoring platform was backdoored upstream. From a silent defense-tamper on the monitoring server, follow a low-and-slow DGA-over-DNS beacon under a single attacker apex, a CNAME redirect to a staged C2, and finally the theft of on-prem token-signing trust that forges SAML tokens into anomalous, MFA-less cloud sign-ins. The DNS resolver log is your sharpest blade.