Scenario A multinational corporation has suffered a cyber attack resulting in the theft of sensitive data. The attack used a previously unseen variant of the BlackEnergy v2 malware. The security team obtained a memory dump from the infected machine and needs a SOC analyst to analyse it to understand the scope and impact of the attack. Tool used: Volatility 3. Investigation Q1. Which Volatility profile is best for this machine? Starting with windows.info to fingerprint the OS: ...
OpenWire — Investigating an Apache ActiveMQ RCE (CVE-2023-46604)
Abstract A network forensics walkthrough of the CyberDefenders OpenWire challenge. Starting from a single PCAP and a tier-1 escalation about a public-facing server beaconing to suspicious IPs, I trace an Apache ActiveMQ compromise via CVE-2023-46604: from the initial remote code execution on the OpenWire port, through a malicious Spring XML payload that abuses java.lang.ProcessBuilder, down to a dropped reverse shell talking to two separate C2 servers. Scenario During your shift as a tier-2 SOC analyst, you receive an escalation from a tier-1 analyst about a public-facing server. The server has been flagged for outbound connections to multiple suspicious IPs. Following the incident response process, the host is isolated from the network and a packet capture is pulled from the NSM sensor. Your task is to analyse the PCAP and assess for signs of malicious activity. ...
Learn Sigma — Reading a Detection Rule for Bitsadmin Abuse
Abstract A walkthrough of the LetsDefend Learn Sigma lab. The goal isn’t to run a tool, but to read a real Sigma rule — proc_creation_win_bitsadmin_download.yml — and understand how its sections (logsource, selection, condition, fields, tags) work together to detect an attacker abusing the legitimate Windows utility bitsadmin.exe to download malicious payloads. Understanding how a detection rule is built is what lets a SOC analyst know why an alert fired, judge false positives, and eventually write rules of their own. ...
ShadowRoast — Threat Hunting an Active Directory Attack with Splunk
Scenario As a cybersecurity analyst at TechSecure Corp, you are alerted to unusual activity in the company’s Active Directory environment. Initial reports suggest unauthorized access and possible privilege escalation. Your task is to analyse the provided logs to uncover the extent of the attack and identify the malicious actions taken by the attacker. Tools used: Splunk, Event Log Explorer. Investigation Q1. What is the malicious file used for initial access? Hunting for process-creation events (Sysmon Event ID 1) on the most likely target (the Office workstation), filtering for cmd/powershell images: ...
AsyncRAT — Unpacking a Multi-Stage Loader (CyberDefenders)
Scenario You are a cybersecurity analyst at Globex Corp. An employee opened an email attachment claiming to be an order specification, which actually carried a JavaScript file designed to deploy AsyncRAT. The malware evades detection efficiently. To secure the network, you must analyse the attachment, reverse-engineer AsyncRAT’s obfuscation techniques, and determine the scope of the infiltration. Tools used: obf-io.deobfuscate.io, CyberChef, DnSpy, the browser console, and PowerShell Get-FileHash. Investigation Q1. What is the name of the variable that conceals the obfuscated code? Opening the script, the malicious logic is buried under heavy obfuscation: ...
YellowRAT — Threat Intelligence on Yellow Cockatoo with VirusTotal
Scenario During a routine IT security check at GlobalTech Industries, abnormal network traffic was detected from multiple workstations. Employees’ search queries were being redirected to unfamiliar websites. Your task is to investigate the incident and gather as much information as possible. Tool used: VirusTotal (plus open-source threat intel). Investigation Q1. What is the name of the malware family causing the abnormal traffic? The challenge provides a file hash, so the starting point is a VirusTotal lookup. The file is flagged by most vendors, with a popular threat label of trojan.msil/polazert and YARA matches for Windows_Trojan_Jupyter and Jupyter_Infostealer_DLL. That label does not match the expected answer format, so I checked the Community tab: ...