CYBRARY SOAR case library
Every SOAR case in one place. Read the theory, see what the scenario simulates, then open the live case console. Cases marked hands-on range ship a simulated host you have to work with real commands.
Network theory: subnets, routing, DNS, ARP, firewalls- F-101Foundations25 min
Anatomy of a workflow run
A phishing-triage workflow has already run and left its mark on the case. Read the run end to end, from node attempts and resolved bindings to branch operands, and say exactly what it changed.
- Scenario:
- Reference playbook provided · 4 entities, low noise
- Theory:
- 4 concepts, 3 graded pitfalls
T1566.002 · Phishing: Spearphishing LinkT1204.001 · User Execution: Malicious LinkT1078 · Valid Accounts - F-102Foundations30 minhands-on range
Credentials, scopes and the vault boundary
A workflow needs to reach a protected system without ever holding the secret that opens it. Bind it to a scoped credential, run the ten-stage health test, and prove no secret reaches a node field, a log or an export.
- Scenario:
- Broken playbook to repair · 4 findings to prove on nw-soar01
- Theory:
- 4 concepts, 3 graded pitfalls
T1552.001 · Unsecured Credentials: Credentials In FilesT1555 · Credentials from Password StoresT1078 · Valid Accounts - X-101Cortex Forge35 min
Incident layout and context paths
A credential-harvest incident lands in XSOAR and the work has to survive being reused tomorrow. Work it through the Work Plan and the War Room, driving every field from context paths instead of hard-coded values.
- Scenario:
- Broken playbook to repair · 5 entities, low noise
- Theory:
- 4 concepts, 3 graded pitfalls
T1566.002 · Phishing: Spearphishing LinkT1204.001 · User Execution: Malicious LinkT1078 · Valid Accounts - X-210Cortex Forge40 min
Sub-playbooks and reversible containment
The enrichment stage is too big to maintain and the containment step is too dangerous to run unattended. Split enrichment into a child playbook, then contain a mailbox rule behind an approval gate a second analyst must clear.
- Scenario:
- Broken playbook to repair · 5 entities, low noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1078 · Valid AccountsT1114.003 · Email Collection: Email Forwarding RuleT1564.008 · Email Hiding Rules - S-101Summit SOAR35 min
Containers, artifacts and CEF discipline
An EDR detection arrives in a shape Phantom cannot work with. Normalize it into a container with correctly typed CEF artifacts, and use Data Preview to catch the null datapath before it breaks the run.
- Scenario:
- Broken playbook to repair · 5 entities, low noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1059.001 · Command and Scripting Interpreter: PowerShellT1003.001 · OS Credential Dumping: LSASS Memory - S-240Summit SOAR45 min
Prompts, child playbooks and host isolation
A finance workstation has to come off the network, and an automated isolation is not something you fire blind. Build the Splunk SOAR playbook with a prompt block for approval, a child playbook for evidence collection and a clean rollback path.
- Scenario:
- Broken playbook to repair · 5 entities, medium noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1003.001 · OS Credential Dumping: LSASS MemoryT1059.001 · Command and Scripting Interpreter: PowerShellT1021.002 · SMB/Windows Admin Shares - T-101Storyline30 min
Storyboard basics and event lineage
Tines works in stories, and every event in one carries its own lineage. Build a compact story that receives an alert, enriches it and opens a case, reading each event in the viewer to trace where its values came from.
- Scenario:
- Broken playbook to repair · 5 entities, low noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1580 · Cloud Infrastructure DiscoveryT1530 · Data from Cloud Storage - T-330Storyline40 min
Change control: test story to live story
A story that works in test has to reach production without carrying test credentials with it. Promote it with credentials and resources rebound per environment, then prove the live run used the promoted version.
- Scenario:
- Broken playbook to repair · 5 entities, low noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1078.004 · Valid Accounts: Cloud AccountsT1098.003 · Additional Cloud Roles - B-301Bridge40 min
From chained hunt to triggered playbook
You promoted a detection out of the chained hunt and it still has nothing downstream of it. Bind it as a workflow trigger and prove the playbook fires on the query's own output, which is the join every SOC has to make before automation means anything.
- Scenario:
- Blank canvas · 9 entities, medium noise
- Theory:
- 4 concepts, 3 graded pitfalls
T1110.003 · Password SprayingT1566.002 · Phishing: Spearphishing LinkT1105 · Ingress Tool TransferT1071.004 · DNS - C-201Cross-platform45 min
One incident, three vocabularies
The same identity-compromise incident has to be worked in three vendors' vocabularies. Move it through all three profiles and map every concept across them, from incident to container to case, without changing the engine underneath.
- Scenario:
- Blank canvas · 5 entities, low noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1078 · Valid AccountsT1114.003 · Email Collection: Email Forwarding RuleT1021.001 · Remote Desktop Protocol - C-320Cross-platform35 min
Idempotency and the duplicate-ticket trap
A flaky ITSM connector times out after it has already created the ticket. Make the retry safe to repeat, because retrying it wrong leaves two tickets in the estate and the duplicate is graded.
- Scenario:
- Blank canvas · 5 entities, medium noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1530 · Data from Cloud StorageT1657 · Financial Theft - C-340Cross-platform40 min
The ticket burst: answering a kerberoasting pass
One workstation asks the domain controller for every service ticket it can get, all in RC4. Name the roasted account from the ticket pattern, adjudicate the source, and reset the credential behind an approval gate — without touching the finance peer that appears in the same alert batch.
- Scenario:
- Blank canvas · 6 entities, medium noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1558.003 · KerberoastingT1078 · Valid AccountsT1049 · System Network Connections Discovery - C-341Cross-platform35 min
The web process that started a shell
The public web service on NW-WEB01 spawned an interactive shell seconds after a request. Establish the parent-child chain, adjudicate the command line, and stop the process tree behind an approval gate without taking the second web node offline with it.
- Scenario:
- Blank canvas · 5 entities, medium noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1059.004 · Command and Scripting Interpreter: Unix ShellT1190 · Exploit Public-Facing ApplicationT1505.003 · Server Software Component: Web Shell - C-342Cross-platform35 min
The account list nobody asked for
A deployment account reads every user, group and service name out of the directory in one pass. Decide whether that is tooling or reconnaissance, name the account behind the query, and cut its directory reach without breaking the deployment it legitimately runs.
- Scenario:
- Blank canvas · 6 entities, high noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1087.002 · Account Discovery: Domain AccountT1069.002 · Permission Groups Discovery: Domain GroupsT1078 · Valid Accounts - C-343Cross-platform35 min
The account with pre-authentication off
The domain controller hands back an AS-REP for an account that never required pre-authentication, which is an offline crack waiting to happen. Find the account, prove the setting rather than the alert, and close the exposure without touching the finance user in the same batch.
- Scenario:
- Blank canvas · 5 entities, medium noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1558.004 · Steal or Forge Kerberos Tickets: AS-REP RoastingT1110.002 · Brute Force: Password CrackingT1078 · Valid Accounts - C-344Cross-platform40 min
The share read end to end
One account walks an entire finance share in twenty minutes — the volume, not the permission, is the finding. Quantify what was read, adjudicate the path, and remove the account's reach behind an approval gate while the nightly backup job keeps running.
- Scenario:
- Blank canvas · 5 entities, medium noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1039 · Data from Network Shared DriveT1083 · File and Directory DiscoveryT1078.002 · Valid Accounts: Domain Accounts - C-345Cross-platform35 min
The archive in a temp folder
A multi-gigabyte archive appears in a temporary directory at two in the morning, built from files the machine has no reason to hold. Attach a forensic copy to the case, decide a verdict on it, and take it out of reach before the next step in the chain sends it anywhere.
- Scenario:
- Blank canvas · 5 entities, medium noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1074.001 · Data Staged: Local Data StagingT1560.001 · Archive Collected Data: Archive via UtilityT1039 · Data from Network Shared Drive - C-346Cross-platform40 min
The swipe at the backups
A refused command tries to delete every shadow copy on the backup server. Nothing was lost, and that is exactly why this is the loudest step in the chain. Treat it as the pre-ransom signal, prove the recovery points are intact, and remove the account's reach into them.
- Scenario:
- Blank canvas · 5 entities, low noise
- Theory:
- 3 concepts, 3 graded pitfalls
T1490 · Inhibit System RecoveryT1486 · Data Encrypted for ImpactT1078 · Valid Accounts - C-347Cross-platform40 min
Reading the passwords out of memory
A tool on the domain controller opened the memory of the process that holds every signed-in credential. Name the process that was read, decide a verdict on the tool, and get the exposed credentials rotated — while leaving the backup agent that reads the same memory for a legitimate reason alone.
- Scenario:
- Blank canvas · 6 entities, high noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1003 · OS Credential DumpingT1003.001 · OS Credential Dumping: LSASS MemoryT1078.002 · Valid Accounts: Domain Accounts - C-348Cross-platform35 min
One password against every account
Hundreds of sign-in failures arrive in a few minutes, one attempt per account, from a single source. Separate a spray from a broken service that is retrying its own password, name the account that finally succeeded, and shut the source out without locking the estate out of itself.
- Scenario:
- Blank canvas · 6 entities, high noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1110 · Brute ForceT1110.003 · Password SprayingT1078 · Valid Accounts - C-349Cross-platform40 min
A certificate in somebody else's name
A workstation asked the certificate service for a certificate naming a domain administrator, and the template let it. Prove which template allowed the request, decide a verdict on the requester, and revoke the certificate before it is used to sign in.
- Scenario:
- Blank canvas · 6 entities, medium noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1548 · Abuse Elevation Control MechanismT1649 · Steal or Forge Authentication CertificatesT1078.002 · Valid Accounts: Domain Accounts - C-350Cross-platform40 min
The cluster handed over its secrets
A pod read every secret in its namespace through the cluster API using its own service account token. Name the service account that was used, decide a verdict on the workload, and rotate the secrets it read while leaving the logging agent that legitimately lists them alone.
- Scenario:
- Blank canvas · 6 entities, medium noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1552.007 · Unsecured Credentials: Container APIT1078.004 · Valid Accounts: Cloud AccountsT1613 · Container and Resource Discovery - C-351Cross-platform45 min
A ticket that crossed the trust
A sign-in arrived in the parent domain carrying authentication material minted in the child, with group membership nobody granted. Compare the ticket against the account it claims, decide a verdict, and shut the path across the trust without cutting the trust itself.
- Scenario:
- Blank canvas · 6 entities, high noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1550 · Use Alternate Authentication MaterialT1134.005 · Access Token Manipulation: SID-History InjectionT1078 · Valid Accounts - C-352Cross-platform30 min
Someone is reading the room
A workstation ran a burst of commands describing itself: the domain it is joined to, the software installed, the privileges it holds. Separate an attacker taking their bearings from the inventory agent that asks the same questions, and decide whether this machine is contained.
- Scenario:
- Blank canvas · 6 entities, high noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1082 · System Information DiscoveryT1033 · System Owner/User DiscoveryT1059.001 · Command and Scripting Interpreter: PowerShell - C-353Cross-platform35 min
The app they said yes to
A user consented to an application that now reads their mail and files on their behalf, with no password involved. Name the permission the grant carries, decide a verdict on the application, and revoke the grant and its tokens before the next sync.
- Scenario:
- Blank canvas · 6 entities, medium noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1528 · Steal Application Access TokenT1114.002 · Email Collection: Remote Email CollectionT1098.001 · Account Manipulation: Additional Cloud Credentials - C-354Cross-platform35 min
Reading the whole knowledge base
An account walked the internal wiki and the reporting database end to end overnight, page after page and table after table. Measure what was actually read, decide a verdict on the account, and cut its access while the analytics service that reads the same tables keeps running.
- Scenario:
- Blank canvas · 6 entities, high noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1213 · Data from Information RepositoriesT1213.002 · Data from Information Repositories: SharepointT1078 · Valid Accounts - C-355Cross-platform35 min
Trusted tool, untrusted payload
A signed Windows utility ran a payload from a user folder, so the process tree looks entirely normal and the signature checks out. Name the loaded file rather than the tool that loaded it, decide a verdict, and stop the same path on the rest of the estate.
- Scenario:
- Blank canvas · 6 entities, high noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1218.011 · System Binary Proxy Execution: Rundll32T1218 · System Binary Proxy ExecutionT1036.005 · Masquerading: Match Legitimate Name or Location - C-356Cross-platform30 min
The printer gave up the directory account
A printer answered a management query with its whole configuration, including the directory account it uses to file scans. Confirm what the query returned, decide a verdict on the source, and rotate the exposed account while leaving the monitoring station's own polling working.
- Scenario:
- Blank canvas · 6 entities, medium noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1602.001 · Data from Configuration Repository: SNMPT1552.001 · Unsecured Credentials: Credentials In FilesT1078.002 · Valid Accounts: Domain Accounts - C-357Cross-platform30 min
The invoice that asked to be enabled
A finance clerk opened a macro-enabled invoice from an external sender and clicked through the warning. Name the file, judge it against the invoices this team receives every day, and clear the same message from every other mailbox it reached.
- Scenario:
- Blank canvas · 6 entities, high noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1566.001 · Phishing: Spearphishing AttachmentT1204.002 · User Execution: Malicious FileT1059.001 · Command and Scripting Interpreter: PowerShell - C-358Cross-platform40 min
Someone else's memory
A program wrote code into a trusted Windows process and let that process do the work, so the network connections belong to something nobody would question. Name what was injected, judge it against the endpoint sensor that reads memory legitimately, and isolate the machine.
- Scenario:
- Blank canvas · 6 entities, high noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1055.001 · Process Injection: Dynamic-link Library InjectionT1071.001 · Application Layer Protocol: Web ProtocolsT1070.004 · Indicator Removal: File Deletion - C-359Cross-platform35 min
A command written so you would not read it
A command line arrived encoded and several layers deep, run from a document process. Read it in plain text, judge it against the deployment account that runs encoded installers every night, and turn on the logging that would have shown it in plain text.
- Scenario:
- Blank canvas · 6 entities, medium noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1027.010 · Obfuscated Files or Information: Command ObfuscationT1105 · Ingress Tool TransferT1562.002 · Impair Defenses: Disable Windows Event Logging - C-360Cross-platform45 min
Persistence with no file to find
A server keeps re-running a command after every reboot, and there is no scheduled task, no service and no startup entry. The instruction is stored in the management database itself. Find the subscription, judge it against the monitoring agent's own, and remove all three of its parts.
- Scenario:
- Blank canvas · 6 entities, medium noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1546.003 · Event Triggered Execution: Windows Management Instrumentation Event SubscriptionT1059.001 · Command and Scripting Interpreter: PowerShellT1078.002 · Valid Accounts: Domain Accounts - C-361Cross-platform35 min
The hour that is missing from the log
An administrator session turned off a logging channel and the estate stopped recording an entire class of activity. Establish which channel went quiet and for how long, judge the session against maintenance work, and get logging back on with a rule that stops it happening quietly again.
- Scenario:
- Blank canvas · 6 entities, medium noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1562.002 · Impair Defenses: Disable Windows Event LoggingT1070.001 · Indicator Removal: Clear Windows Event LogsT1078.002 · Valid Accounts: Domain Accounts - C-362Cross-platform35 min
Approve, approve, approve
An account was flooded with approval prompts through the night until somebody tapped yes. Count the prompts, judge the source against the help desk's own re-enrollment traffic, and cut the session before deciding what the intruder reached.
- Scenario:
- Blank canvas · 6 entities, high noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1621 · Multi-Factor Authentication Request GenerationT1078 · Valid AccountsT1114.002 · Email Collection: Remote Email Collection - C-363Cross-platform40 min
Signed in without ever signing in
A session token lifted from a browser was replayed from a machine that never authenticated, so there is no failed password and no prompt to approve. Name the token, judge the new device against traveling staff, and invalidate the session everywhere.
- Scenario:
- Blank canvas · 6 entities, high noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1550.004 · Use Alternate Authentication Material: Web Session CookieT1539 · Steal Web Session CookieT1114.003 · Email Collection: Email Forwarding Rule - C-364Cross-platform45 min
A tunnel inside ordinary traffic
One long-lived encrypted session to a content-delivery name is carrying interactive traffic in both directions. Establish which destination it is, judge it against the estate's real content cache, and close the path without breaking the build network.
- Scenario:
- Blank canvas · 6 entities, high noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1572 · Protocol TunnelingT1090.001 · Proxy: Internal ProxyT1071.001 · Application Layer Protocol: Web Protocols - C-365Cross-platform40 min
Out through the personal drive
A departing employee's machine uploaded gigabytes to a personal cloud account over a weekend, through the same service the company itself uses. Establish what left, judge the destination against the sanctioned archive job, and stop the route without blocking the business's own storage.
- Scenario:
- Blank canvas · 6 entities, high noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1567.002 · Exfiltration Over Web Service: Exfiltration to Cloud StorageT1074.001 · Data Staged: Local Data StagingT1070.004 · Indicator Removal: File Deletion - C-366Cross-platform45 min
Nothing to decrypt
Files on a production share were overwritten and deleted rather than encrypted, so there is no note and nothing to pay for. Establish the tool and the scope, judge it against the retention job that deletes expired files, and get the share back from a recovery point.
- Scenario:
- Blank canvas · 6 entities, medium noise
- Theory:
- 3 concepts, 2 graded pitfalls
T1485 · Data DestructionT1490 · Inhibit System RecoveryT1078.002 · Valid Accounts: Domain Accounts - A-210AI safety40 minhands-on range
Prompt injection in an alert body
An attacker plants instructions inside the body of a phishing email your assistant is about to read. Use the AI Workbench to summarize and plan while keeping that text as data, and refuse the tool the injection tries to trigger.
- Scenario:
- Broken playbook to repair · 6 findings to prove on ai-agent01
- Theory:
- 3 concepts, 3 graded pitfalls
T1566.002 · Phishing: Spearphishing LinkT1204.001 · User Execution: Malicious LinkT1199 · Trusted Relationship - A-220AI safety45 minhands-on range
A poisoned tool in the agent's own catalog
An MCP server the SOC trusts ships a tool whose description tells the agent to exfiltrate case notes for validation. Catch it in the catalog rather than in the audit log, and contain the agent's session without breaking the honest tools beside it.
- Scenario:
- Broken playbook to repair · 6 findings to prove on ai-agent01
- Theory:
- 3 concepts, 3 graded pitfalls
T1195.002 · Supply Chain Compromise: Compromise Software Supply ChainT1199 · Trusted RelationshipT1078.004 · Valid Accounts: Cloud AccountsT1567 · Exfiltration Over Web Service - A-230AI safety75 minhands-on range
AI security capstone — autonomous triage under oversight
The assistant triages the queue on its own overnight. Review what it did, catch the one action it should have stopped for, and rebuild the oversight boundary so the same shift is safe to repeat.
- Scenario:
- Broken playbook to repair · 7 findings to prove on ai-agent01
- Theory:
- 3 concepts, 3 graded pitfalls
T1204.001 · User Execution: Malicious LinkT1199 · Trusted RelationshipT1078.004 · Valid Accounts: Cloud AccountsT1562.001 · Disable or Modify Tools - K-A01Capstone90 min
Capstone A — identity compromise, end to end
An identity compromise runs from a risky sign-in to a mailbox rule to a lateral attempt. Author the workflow, bind scoped credentials, run it under approval, work the case, and defend your score with evidence.
- Scenario:
- Blank canvas · 9 entities, high noise
- Theory:
- 4 concepts, 3 graded pitfalls
T1078 · Valid AccountsT1114.003 · Email Collection: Email Forwarding RuleT1021.001 · Remote Desktop ProtocolT1550.001 · Use Alternate Authentication Material: Application Access TokenT1003.001 · OS Credential Dumping: LSASS Memory - K-B01Capstone90 min
Capstone B — query to containment, with a written debrief
The whole arc lands in one sitting, from exposure to written debrief. Hunt the exposure, trigger the playbook from your own detection, contain under approval, then file the debrief the cohort report reads, with coverage claimed, blind spot named and owner assigned.
- Scenario:
- Blank canvas · 9 entities, high noise
- Theory:
- 4 concepts, 3 graded pitfalls
T1580 · Cloud Infrastructure DiscoveryT1530 · Data from Cloud StorageT1078.004 · Valid Accounts: Cloud AccountsT1098.003 · Additional Cloud RolesT1048.003 · Exfiltration Over Unencrypted Non-C2 Protocol - K-C01Capstone75 min
SOC Analyst Capstone — live telemetry to containment
The analyst capstone runs on the estate's live telemetry rather than a fixture. Hunt with searches that execute against the real index, build the case on those results, contain the endpoint and the identity under approval, and file the debrief the cohort report reads.
- Scenario:
- Blank canvas · 5 entities, high noise
- Theory:
- 4 concepts, 3 graded pitfalls
T1110.003 · Password SprayingT1105 · Ingress Tool TransferT1071.004 · DNST1048.003 · Exfiltration Over Unencrypted Non-C2 ProtocolT1078 · Valid Accounts - H-201Cross-platform45 minhands-on range
Prove it before you isolate: hands-on containment
A finance workstation is beaconing and nobody has looked at the host itself. Work it in the range console, through processes, sockets and unit files, file the three facts you can prove, then build the containment playbook around them.
- Scenario:
- Blank canvas · 6 findings to prove on fin-ws14
- Theory:
- 4 concepts, 3 graded pitfalls
T1543.002 · Create or Modify System Process: Systemd ServiceT1071.001 · Application Layer Protocol: Web ProtocolsT1057 · Process DiscoveryT1049 · System Network Connections DiscoveryT1489 · Service Stop - H-301Cross-platform75 minhands-on range
Northwind portal breach: detect, contain, debrief
The customer portal was compromised through an upload bypass at 01:12, the portal service account reached the finance database, and 1.4GB left the building. Work the box, prove the breach, contain what the evidence implicates, then write the post-incident record.
- Scenario:
- Blank canvas · 9 findings to prove on nw-portal01
- Theory:
- 4 concepts, 4 graded pitfalls
T1190 · Exploit Public-Facing ApplicationT1505.003 · Server Software Component: Web ShellT1078 · Valid AccountsT1071.001 · Application Layer Protocol: Web ProtocolsT1041 · Exfiltration Over C2 Channel - H-302Cross-platform75 minhands-on range
Northwind order portal breach: the Windows side
An IIS application server took an unrestricted upload at 02:47, the app-pool identity reached the order file server over SMB, and a 3.1GB archive is leaving right now. Work the box with cmd.exe, prove all three phases, then contain what the evidence implicates.
- Scenario:
- Blank canvas · 9 findings to prove on nw-app02
- Theory:
- 4 concepts, 4 graded pitfalls
T1190 · Exploit Public-Facing ApplicationT1505.003 · Server Software Component: Web ShellT1059.001 · Command and Scripting Interpreter: PowerShellT1021.002 · SMB/Windows Admin SharesT1053.005 · Scheduled Task/Job: Scheduled TaskT1041 · Exfiltration Over C2 Channel - H-303Cross-platform70 minhands-on range
SELinux went quiet on the Northwind API server
A RHEL 9 API server stopped enforcing SELinux at 23:10, and two minutes later a systemd service and timer began beaconing every ten minutes. Work the host with journalctl, systemctl and the SELinux tooling, contain it, and record why the denials that used to stop this stopped firing.
- Scenario:
- Blank canvas · 9 findings to prove on nw-api05
- Theory:
- 4 concepts, 4 graded pitfalls
T1562.001 · Disable or Modify ToolsT1543.002 · Create or Modify System Process: Systemd ServiceT1053.006 · Scheduled Task/Job: Systemd TimersT1071.001 · Application Layer Protocol: Web ProtocolsT1078 · Valid Accounts - H-304Cross-platform60 minhands-on range
The key that let itself back into the Northwind build host
An unfamiliar SSH key appeared in the build account's authorized_keys at 02:14, a NOPASSWD sudoers drop-in followed seconds later, and a cron job now calls out every nine minutes. Work nw-ci01 with the shell, prove the access path, contain it, and record why the host was reachable at all.
- Scenario:
- Blank canvas · 9 findings to prove on nw-ci01
- Theory:
- 4 concepts, 4 graded pitfalls
T1098.004 · Account Manipulation: SSH Authorized KeysT1053.003 · Scheduled Task/Job: CronT1548.003 · Abuse Elevation Control Mechanism: Sudo and Sudo CachingT1071.001 · Application Layer Protocol: Web ProtocolsT1078 · Valid Accounts - H-305Cross-platform75 minhands-on range
The upload handler that loaded a rootkit on nw-web03
Two POSTs to an image directory returned 200 on the Northwind portal, and minutes later ld.so.preload began loading an unsigned library into every new process. Work the web tier, prove the webshell and the preload hook, contain the live session, and record the version that allowed the upload.
- Scenario:
- Blank canvas · 9 findings to prove on nw-web03
- Theory:
- 4 concepts, 4 graded pitfalls
T1190 · Exploit Public-Facing ApplicationT1505.003 · Server Software Component: Web ShellT1574.006 · Hijack Execution Flow: Dynamic Linker HijackingT1071.001 · Application Layer Protocol: Web ProtocolsT1078 · Valid Accounts - H-306Cross-platform65 minhands-on range
Three kinds of persistence from one macro on NW-HR01
A macro-enabled benefits document on an HR workstation spawned hidden PowerShell, and four minutes later a Run key, a service and a scheduled task all pointed at unsigned binaries. Work NW-HR01 with cmd.exe and Event Viewer, contain it, and record the persistence you would have missed.
- Scenario:
- Blank canvas · 9 findings to prove on nw-hr01
- Theory:
- 4 concepts, 4 graded pitfalls
T1204.002 · User Execution: Malicious FileT1547.001 · Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderT1543.003 · Create or Modify System Process: Windows ServiceT1071.001 · Application Layer Protocol: Web ProtocolsT1053.005 · Scheduled Task/Job: Scheduled Task - H-307Cross-platform80 minhands-on range
A new administrator and a cleared Security log on NW-DC01
At 04:18 an account was created on the Northwind domain controller and added to Administrators, a service followed, and at 04:41 the Security log was cleared by that same account. Reconstruct what the clearing was meant to hide, contain the controller, and record the anti-forensics.
- Scenario:
- Blank canvas · 9 findings to prove on nw-dc01
- Theory:
- 4 concepts, 4 graded pitfalls
T1136.001 · Create Account: Local AccountT1098 · Account ManipulationT1543.003 · Create or Modify System Process: Windows ServiceT1070.001 · Indicator Removal: Clear Windows Event LogsT1071.001 · Application Layer Protocol: Web Protocols - N-401Cross-platform55 minhands-on range
Prove the Northwind network is actually segmented
Audit finding NW-AUD-114 says nobody can demonstrate the corporate VLAN is separated from the server farm, the DMZ and the internet. You get a seat on an ordinary endpoint and nothing else, so prove the design from the wire, including the endpoint holding a session it should not have.
- Scenario:
- Blank canvas · 8 findings to prove on nw-net21
- Theory:
- 4 concepts, 4 graded pitfalls
T1046 · Network Service DiscoveryT1018 · Remote System DiscoveryT1016 · System Network Configuration DiscoveryT1049 · System Network Connections DiscoveryT1071.001 · Application Layer Protocol: Web Protocols - N-402Cross-platform45 minhands-on range
Find the rogue device wired into the corporate VLAN
An access switch learned a hardware address that appears in no inventory. From a seat on the same VLAN, sweep the subnet, fingerprint the service the device publishes, and prove which rule keeps it away from the file shares. Then find the corporate endpoint already routing through it.
- Scenario:
- Blank canvas · 8 findings to prove on nw-net22
- Theory:
- 4 concepts, 4 graded pitfalls
T1200 · Hardware AdditionsT1046 · Network Service DiscoveryT1018 · Remote System DiscoveryT1557 · Adversary-in-the-MiddleT1071.001 · Application Layer Protocol: Web Protocols - N-403Cross-platform50 minhands-on range
Rebuild the Northwind rule base from the wire
Three firewall migrations later, nobody can say which rules exist, and change control will not approve the next one without evidence. You get an ordinary corporate seat, no console and no exported config. Probe each zone crossing until the rule base identifies itself by number.
- Scenario:
- Blank canvas · 8 findings to prove on nw-net31
- Theory:
- 4 concepts, 4 graded pitfalls
T1046 · Network Service DiscoveryT1016 · System Network Configuration DiscoveryT1018 · Remote System DiscoveryT1049 · System Network Connections Discovery - N-404Cross-platform60 minhands-on range
Follow a breach across the subnets it crossed
Overnight the perimeter logged unusual SMTP from the published web host into the server farm, then outbound TLS from an application server. You get a shell on that server, so work out which DMZ host reached it, which rule carried the data out, and which file server was touched.
- Scenario:
- Blank canvas · 8 findings to prove on nw-app07
- Theory:
- 4 concepts, 4 graded pitfalls
T1190 · Exploit Public-Facing ApplicationT1210 · Exploitation of Remote ServicesT1021.002 · SMB/Windows Admin SharesT1071.001 · Application Layer Protocol: Web ProtocolsT1041 · Exfiltration Over C2 Channel - P-401Capstone60 minhands-on range
Write the playbook: author, debug, submit
You are on the Northwind automation runner with an unhandled event sitting in the queue. Read the event, prove the beacon on the connector, then write the playbook yourself, debug it until the review is clean, and submit it for grading.
- Scenario:
- Blank canvas · 6 findings to prove on nw-auto01
- Theory:
- 4 concepts, 4 graded pitfalls
T1071.001 · Application Layer Protocol: Web ProtocolsT1543.003 · Create or Modify System Process: Windows ServiceT1105 · Ingress Tool TransferT1041 · Exfiltration Over C2 Channel - A-240AI safety40 minhands-on range
The confused deputy: an agent spending someone else's authority
A user signed in once to let the assistant read a file. Minutes later the assistant is writing to finance with that signature. Work the runner's token log, prove where the authority changed hands, and close the boundary without breaking the honest workflow.
- Scenario:
- Broken playbook to repair · 6 findings to prove on ai-agent01
- Theory:
- 3 concepts, 3 graded pitfalls
T1134.005 · Access Token Manipulation: SID-History InjectionT1550 · Use Alternate Authentication MaterialT1078.004 · Valid Accounts: Cloud Accounts - A-250AI safety40 minhands-on range
A summary job that published the customer book
An assistant asked to summarize renewals read the entire customer database and wrote it to a scratch bucket with a public template policy. Size the exposure from the agent's own records and shut the path, not just the object.
- Scenario:
- Broken playbook to repair · 6 findings to prove on ai-agent01
- Theory:
- 3 concepts, 3 graded pitfalls
T1530 · Data from Cloud StorageT1567.002 · Exfiltration Over Web Service: Exfiltration to Cloud StorageT1078.004 · Valid Accounts: Cloud Accounts - A-255AI safety35 minhands-on range
Memory contamination: a rule nobody wrote
The assistant is resetting finance passwords without a ticket and citing a policy that does not exist. The policy is in its durable memory, written by a tool rather than a person. Find the note, prove where it came from, and decide what memory is allowed to authorize.
- Scenario:
- Broken playbook to repair · 6 findings to prove on ai-agent01
- Theory:
- 3 concepts, 3 graded pitfalls
T1199 · Trusted RelationshipT1204.001 · User Execution: Malicious LinkT1078 · Valid Accounts - A-260AI safety35 minhands-on range
Blast radius: prove how far the agent's account got
The runner's service account was used from machine to machine overnight. Run the reachability sweep on the host, corroborate it in the logs, and answer the only question containment depends on: a path, or actual spread?
- Scenario:
- Broken playbook to repair · 6 findings to prove on ai-agent01
- Theory:
- 3 concepts, 3 graded pitfalls
T1021.002 · SMB/Windows Admin SharesT1078 · Valid AccountsT1550 · Use Alternate Authentication Material - A-270AI safety35 minhands-on range
Written by a machine: the quote that changed the bank details
A supplier quote in the intake queue reads like a model wrote it, and it carries new remittance details. Score it against the genuine quote from the same supplier, read its provenance manifest and the mail headers, and decide what is actually proven before anyone pays.
- Scenario:
- Broken playbook to repair · 5 findings to prove on ai-review01
- Theory:
- 4 concepts, 4 graded pitfalls
T1566.001 · Phishing: Spearphishing AttachmentT1078 · Valid Accounts - A-280AI safety40 minhands-on range
Adverse impact: the model that ranks the shift
A screening model reached serving with no fairness gate. Its own evaluation wrote the selection counts to disk. Compare the rates across sites, apply the four-fifths rule, find the unapproved feature standing in for the site, and contain the serving node without punishing the team that built it.
- Scenario:
- Broken playbook to repair · 4 findings to prove on ai-mlops01
- Theory:
- 4 concepts, 4 graded pitfalls
T1078 · Valid AccountsT1199 · Trusted Relationship - A-290AI safety35 minhands-on range
The obligation nobody wrote down: classifying an AI system
A deployed system ranks people for promotion and its inventory record has an empty risk class. Classify it from the framework text, find the control with no evidence and the risk with no owner, and hold the deployment identity until a conformity assessment exists.
- Scenario:
- Broken playbook to repair · 4 findings to prove on grc01
- Theory:
- 4 concepts, 4 graded pitfalls
T1078 · Valid AccountsT1199 · Trusted Relationship - A-300AI safety35 minhands-on range
The model nobody signed
A latency fix put a new model version into serving overnight. Read the pull log, the digest check and the model card: establish where it came from, whether it is what it claims to be, and why its file format alone is a containment decision.
- Scenario:
- Broken playbook to repair · 4 findings to prove on ai-build01
- Theory:
- 4 concepts, 4 graded pitfalls
T1195.002 · Supply Chain Compromise: Compromise Software Supply ChainT1554 · Compromise Host Software Binary - A-310AI safety35 minhands-on range
The erasure that never reached the model
A deletion request was completed in the business systems in January. The training set still carries the subject, and the model in serving was trained from that set. Count what remains, check the lineage dates, and say plainly whether deleting the rows is enough.
- Scenario:
- Broken playbook to repair · 4 findings to prove on ai-data01
- Theory:
- 4 concepts, 4 graded pitfalls
T1530 · Data from Cloud StorageT1078 · Valid Accounts - A-320AI safety35 minhands-on range
Telling the regulator what happened
A screening model rejected eligible applicants for a day. Classify the incident against the threshold text using the record's own numbers, work the reporting clock from detection, and find the inventory artifact the system has never had.
- Scenario:
- Broken playbook to repair · 4 findings to prove on ai-grc02
- Theory:
- 4 concepts, 4 graded pitfalls
T1078 · Valid AccountsT1199 · Trusted Relationship - G-310Governance evidence35 minhands-on range
The access review that approved itself
A quarterly access review is signed off and the bundle is ready for the auditor. Read the decision file rather than the summary: work out who reviewed their own entitlement, how many accounts are stale by the bundle's own definition, and which file no longer matches its recorded digest.
- Scenario:
- Broken playbook to repair · 4 findings to prove on grc-evid01
- Theory:
- 4 concepts, 4 graded pitfalls
T1078 · Valid AccountsT1098 · Account Manipulation - G-320Governance evidence40 minhands-on range
The processor nobody papered
A scoring vendor has been live on customer data for months. The register says one thing, the egress log says another, and a confirmed breach notice is sitting in the folder with a statutory clock already running. Work out the exposure and stop the transfer without cutting off the vendors that are properly papered.
- Scenario:
- Broken playbook to repair · 4 findings to prove on grc-tprm01
- Theory:
- 4 concepts, 4 graded pitfalls
T1199 · Trusted RelationshipT1530 · Data from Cloud Storage - G-330Governance evidence35 minhands-on range
Closed on paper, open on the host
An audit finding was closed three months ago on a screenshot. Last night's configuration scan still shows the setting it was raised about. Prove the drift from the scan, reopen the right finding, and take the host out of the change baseline until it is genuinely fixed.
- Scenario:
- Broken playbook to repair · 4 findings to prove on grc-app05
- Theory:
- 4 concepts, 4 graded pitfalls
T1078 · Valid AccountsT1562.001 · Disable or Modify Tools - N-405Cross-platform40 minhands-on range
Walk the physical path: why the yard is slow
Dispatch say the yard crawls and the cabling record is four years stale. Sit at the yard seat, ping each segment, walk the path hop by hop and read the physical layer off the kit: what each leg is made of, how far it runs and what it negotiated. Then say which of the two faults the yard actually feels.
- Scenario:
- Blank canvas · 5 findings to prove on nw-yard41
- Theory:
- 3 concepts, 4 graded pitfalls
T1046 · Network Service DiscoveryT1016 · System Network Configuration DiscoveryT1049 · System Network Connections Discovery - N-410Cross-platform40 minhands-on range
Read the air: signal, interference and airtime on the yard radio
The yard's handhelds keep dropping and a bigger access point will not fix it. Measure the cell in the wireless console: channel, noise floor, non-Wi-Fi energy on that channel, the cells sharing it, and the station at the bottom of the rate table eating the airtime. Then name the channel to move to.
- Scenario:
- Blank canvas · 7 findings to prove on nw-yard41
- Theory:
- 4 concepts, 5 graded pitfalls
T1016 · System Network Configuration DiscoveryT1046 · Network Service Discovery - V-510Cross-platform45 minhands-on range
Stand the platform up: two bare hosts to the written baseline
Two hypervisor hosts arrived with nothing configured — no time sources, no lockdown, no log target, no failover, one path to the shared store and every guest powered off. Read the baseline score, bring the platform up to the written standard, power the guests on, and prove the score moved.
- Scenario:
- Blank canvas · 6 findings to prove on nw-plat01
- Theory:
- 4 concepts, 4 graded pitfalls
T1082 · System Information DiscoveryT1078 · Valid AccountsT1016 · System Network Configuration Discovery - V-520Cross-platform45 minhands-on range
The platform you inherited: measure it before you touch it
Everything runs on one host, every guest was sized by whoever asked loudest, and the archive store has a single path. The ticket says 'the virtual machines are slow' with no numbers attached. Measure the contention, name the cause, fix it, and measure again.
- Scenario:
- Blank canvas · 6 findings to prove on nw-plat01
- Theory:
- 4 concepts, 4 graded pitfalls
T1082 · System Information DiscoveryT1046 · Network Service DiscoveryT1078 · Valid Accounts - V-530Cross-platform40 minhands-on range
Break it on purpose: watch the platform answer
A healthy, hardened platform and permission to spoil it: pile on virtual cores and read the wait time, promise memory the host cannot back and watch it leave the guests, then pull a storage path and read the response time. Put every change back and prove the score returned.
- Scenario:
- Blank canvas · 7 findings to prove on nw-plat01
- Theory:
- 4 concepts, 4 graded pitfalls
T1082 · System Information DiscoveryT1046 · Network Service DiscoveryT1078 · Valid Accounts - V-540Cross-platform45 minhands-on range
The store stopped answering: a pause, a loss, and the mess left behind
One datastore has gone quiet and the guests on it hang rather than error. A machine carries delta files a failed backup never consolidated, and the gold store is fuller than its guests can account for. Tell a pause from a permanent loss, release the disk the backup holds, hand the space back, and prove the score moved.
- Scenario:
- Blank canvas · 6 findings to prove on nw-plat01
- Theory:
- 4 concepts, 4 graded pitfalls
T1082 · System Information DiscoveryT1046 · Network Service DiscoveryT1078 · Valid Accounts - V-550Cross-platform45 minhands-on range
The console went dark: hung agents, a dead clock and a full log disk
Nobody can manage anything. A host has dropped out of the console with its guests still running, a certificate is days from lapsing, a clock is fifteen minutes out and the appliance stops its own services. Repair the management plane in the right order and prove it.
- Scenario:
- Blank canvas · 6 findings to prove on nw-plat01
- Theory:
- 4 concepts, 4 graded pitfalls
T1082 · System Information DiscoveryT1078 · Valid AccountsT1070.004 · Indicator Removal: File Deletion - V-560Cross-platform40 minhands-on range
Migrations stall at 21%: frame sizes and half-configured bonding
Live migrations start, sit at the same percentage and time out. One host was given jumbo frames by somebody testing storage, and one port group was set to bond its uplinks while the physical switch was never touched. Read the refusal, find both mismatches, and put each end back in agreement.
- Scenario:
- Blank canvas · 5 findings to prove on nw-plat01
- Theory:
- 4 concepts, 4 graded pitfalls
T1082 · System Information DiscoveryT1046 · Network Service DiscoveryT1016 · System Network Configuration Discovery - V-570Cross-platform45 minhands-on range
Four tickets, one resolver: name resolution, profile drift and a stale gold image
A failover agent that will not configure, a certificate renewal that fails, logs that stopped arriving and a clock that is out - all on one host. Find the one cause under all four, then bring the host back to its profile and put a stale gold image in order.
- Scenario:
- Blank canvas · 6 findings to prove on nw-plat01
- Theory:
- 4 concepts, 4 graded pitfalls
T1082 · System Information DiscoveryT1078 · Valid AccountsT1195.002 · Supply Chain Compromise: Compromise Software Supply Chain - H-610Cross-platform45 minhands-on range
Stand the Hyper-V cluster up: two nodes to the written baseline
Two Windows Server nodes arrived with the Hyper-V role added and nothing else done: no time sources, no Credential Guard, live migration off, no quorum witness and one path to the volumes. Read the baseline score, bring the cluster to the written standard, and prove the score moved.
- Scenario:
- Blank canvas · 6 findings to prove on nw-hvadm01
- Theory:
- 4 concepts, 4 graded pitfalls
T1082 · System Information DiscoveryT1078 · Valid AccountsT1016 · System Network Configuration Discovery - H-620Cross-platform45 minhands-on range
The Hyper-V cluster you inherited: measure it before you touch it
Everything runs on one node, every machine has static memory sized by whoever asked loudest, and the volumes have a single path. The ticket says 'the VMs are slow' with no numbers attached. Measure the contention, name the cause, fix it, and measure again.
- Scenario:
- Blank canvas · 6 findings to prove on nw-hvadm01
- Theory:
- 4 concepts, 4 graded pitfalls
T1082 · System Information DiscoveryT1046 · Network Service DiscoveryT1078 · Valid Accounts - H-630Cross-platform40 minhands-on range
Break the Hyper-V cluster on purpose, and watch every number move
You are handed a healthy, hardened cluster and permission to spoil it. Pile processors onto the machines on one node, promise memory the node cannot back, take a storage path away, remove the quorum witness, and try two changes the platform should refuse. Read the counters after each one, then put it all back.
- Scenario:
- Blank canvas · 8 findings to prove on nw-hvadm01
- Theory:
- 4 concepts, 4 graded pitfalls
T1082 · System Information DiscoveryT1046 · Network Service DiscoveryT1078 · Valid Accounts - H-640Cross-platform45 minhands-on range
Three tickets, one resolver: Kerberos, baseline drift and a stale gold image
Live migration onto the second node fails authentication, its events stopped arriving and its clock is out. Find the one cause under all three, then bring the node back to the cluster baseline and put a stale gold image in order.
- Scenario:
- Blank canvas · 6 findings to prove on nw-hvadm01
- Theory:
- 4 concepts, 4 graded pitfalls
T1082 · System Information DiscoveryT1078 · Valid AccountsT1195.002 · Supply Chain Compromise: Compromise Software Supply Chain