INVESTIGATE
#022 · SOFTWARE SUPPLY CHAIN
TODAYThe Package Name Is One Letter Off
A build pulled a dependency that looks almost—but not quite—familiar.
- ~5 min
- +100 XP
- Intermediate
Daily Incidents
Three to five minutes. Incomplete information. What would you do?
INVESTIGATION SERIES
Cloud & Identity Attack Pack
Ten simulated cases on session abuse, cloud exposure, and identity decisions.
Start series
0 of 48 investigated · 48 shown
- INVESTIGATE
#001 · IDENTITY & ACCESS
46 Failed Logins. Then One Succeeds.
An employee account generated unusual authentication activity.
- ~3 min
- +100 XP
- Beginner
- INVESTIGATE
#002 · ENDPOINT SECURITY
Word Just Launched PowerShell
An EDR alert fired on an unusual process chain.
- ~3 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#003 · EMAIL SECURITY
Your Password Expires Today
An employee reported a suspicious password expiration email.
- ~3 min
- +100 XP
- Beginner
- INVESTIGATE
#004 · IDENTITY & ACCESS
The Impossible Travel Alert
One account, two logins, two distant locations.
- ~4 min
- +100 XP
- Beginner
- INVESTIGATE
#005 · IDENTITY & ACCESS
The Suspicious OAuth App
A user granted a third-party app access to their account.
- ~4 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#006 · ENDPOINT SECURITY
A Scheduled Task Appears
EDR flags a newly created scheduled task after a document opened.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#007 · THREAT DETECTION
DNS Every 60 Seconds
A workstation keeps querying the same unusual domain.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#008 · IDENTITY & ACCESS
A Reporting Add-On Wants Full Mailbox Access
A consent event appears for an app nobody in IT recognises.
- ~4 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#009 · IDENTITY & ACCESS
Two Continents, Eleven Minutes Apart
An impossible travel alert that does not resolve as neatly as the last one.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#010 · ENDPOINT SECURITY
Encoded PowerShell at 18:40
A spreadsheet closed twenty minutes ago. Something it started did not.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#011 · CLOUD SECURITY
The Bucket Went Public at 14:06
A configuration change exposed a storage container. Now what does that actually mean?
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#012 · IDENTITY & ACCESS
A New Administrator at 02:13
A privileged account appeared overnight. The hour is the least interesting part.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#013 · THREAT DETECTION
Every 300 Seconds, Almost Exactly
A host is checking in with the same domain. Software does that too.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#014 · DIGITAL FORENSICS
The Missing USB Drive
A departing employee, a removable drive, and a lot of assumptions to avoid.
- ~5 min
- +100 XP
- Intermediate
- INVESTIGATE
#015 · IDENTITY & ACCESS
MFA Fatigue at 3:17 AM
Eleven push prompts. One approval. Nobody meant to sign in.
- ~4 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#016 · IDENTITY & ACCESS
Former Employee Account Still Active
He left in June. Something is still signing in as him.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#017 · IDENTITY & ACCESS
Help Desk Password Reset
"I'm on the road, I lost my phone, and the board call is in ten minutes."
- ~3 min
- +100 XP
- Beginner
- INVESTIGATE
#018 · IDENTITY & ACCESS
Privileged Role Activated for 47 Minutes
The elevation was approved. One of the actions was not.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#019 · IDENTITY & ACCESS
Dormant Service Account Wakes Up
Silent for 180 days, then authenticating every four minutes.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#020 · IDENTITY & ACCESS
Contractor Still Has Production Access
The contract ended in July. The access did not.
- ~3 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#021 · CLOUD IDENTITY
Internal OAuth App Requests Directory Access
The team built it themselves. The scopes are still too wide.
- ~4 min
- +100 XP
- Intermediate
- INVESTIGATE
#023 · CLOUD SECURITY
A CI Token Appears in a Public Commit
The secret was deleted five minutes later. The exposure was not.
- ~4 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#024 · NETWORK INVESTIGATION
RDP Between Two Workstations
It could be support activity. It could also be lateral movement.
- ~5 min
- +100 XP
- Intermediate
- INVESTIGATE
#025 · EXPOSURE MANAGEMENT
The Scanner Found an Admin Portal
Internet-facing is not the same thing as compromised—but it still matters.
- ~4 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#026 · THIRD-PARTY RISK
The Vendor Downloaded the Entire Export
The account was authorized. The volume and purpose may not have been.
- ~5 min
- +100 XP
- Intermediate
- INVESTIGATE
#027 · BROWSER SECURITY
A Browser Extension Reads Every Page
The permission is broad. The behavior determines whether it is merely risky—or malicious.
- ~4 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#028 · DIGITAL FORENSICS
The Timestamp That Changed the Story
Three logs appear to disagree until the clocks are normalized.
- ~5 min
- +100 XP
- Intermediate
- INVESTIGATE
#029 · NETWORK SECURITY
DNS Queries Carry More Than Hostnames
A workstation is sending long, regular subdomain queries to a newly registered domain.
- ~5 min
- +100 XP
- Intermediate
- INVESTIGATE
#030 · CLOUD SECURITY
A Public Function Returns Customer Records
A serverless endpoint works without authentication—and accepts any customer identifier.
- ~4 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#031 · EMAIL SECURITY
The Vendor Changed Its Bank Details
A real invoice thread now contains new payment instructions and a slightly different reply-to address.
- ~4 min
- +100 XP
- Beginner
- INVESTIGATE
#032 · ENDPOINT SECURITY
A Signed Utility Loads an Unknown DLL
A trusted Windows binary starts after a download and loads code from a user-writable folder.
- ~5 min
- +100 XP
- Intermediate
- INVESTIGATE
#033 · THREAT INTELLIGENCE
A New Domain Copies Your Help Desk
A newly registered site mirrors the support portal and is already appearing in sponsored search results.
- ~4 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#034 · GOVERNANCE, RISK & COMPLIANCE
The Security Control Passed on Paper
A quarterly review marks backups effective, but nobody has restored one in eleven months.
- ~4 min
- +100 XP
- Beginner
- INVESTIGATE
#035 · DIGITAL FORENSICS
Windows Logs Stop at 02:14
An administrator account signs in, a service is created, and the local event log suddenly goes quiet.
- ~5 min
- +100 XP
- Intermediate
- INVESTIGATE
#036 · OT & IOT SECURITY
A Building Controller Joins the Office Network
An unmanaged HVAC controller appears in the same segment as employee workstations.
- ~4 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#037 · APPLICATION SECURITY
One Customer Can Read Another's Order
Changing a number in an API request returns a valid record owned by a different account.
- ~5 min
- +100 XP
- Intermediate
- INVESTIGATE
#038 · INCIDENT RESPONSE
The Ransom Note Arrives Before Scope Is Known
Three file shares are encrypted, but the identity and backup systems still appear healthy.
- ~5 min
- +100 XP
- Intermediate
- INVESTIGATE
#039 · IDENTITY & ACCESS
NEWThe MFA Prompt That Wasn't Enough
A successful MFA event precedes a new session from an unfamiliar device.
- ~5 min
- +100 XP
- Intermediate
- INVESTIGATE
#040 · IDENTITY & ACCESS
NEWOne Password, Many Accounts
One source tries the same password across many usernames.
- ~5 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#041 · IDENTITY & ACCESS
NEWThe Device Code Someone Else Entered
An employee enters a code from a chat message into a legitimate Microsoft page.
- ~5 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#042 · IDENTITY & ACCESS
NEWA New MFA Method Appears
An account gains a new authenticator after an unusual sign-in.
- ~5 min
- +100 XP
- Intermediate
- INVESTIGATE
#043 · CLOUD SECURITY
NEWA Service Principal Gets a Broad Grant
An app gains tenant-wide permissions shortly before a large data pull.
- ~5 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#044 · CLOUD SECURITY
NEWThe Bucket Is Public—Was It Read?
A storage policy allows public reads, but exposure and access are separate findings.
- ~5 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#045 · CLOUD SECURITY
NEWA Key Calls APIs After Rotation
A legacy cloud access key remains active after a planned rotation.
- ~5 min
- +100 XP
- Intermediate
- INVESTIGATE
#046 · CLOUD SECURITY
NEWAn Emergency Role Was Assumed
An unusual principal assumes a privileged role during an outage.
- ~5 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#047 · IDENTITY & ACCESS
NEWThe Conditional Access Exception
A new policy exclusion permits an unmanaged device to reach a sensitive app.
- ~5 min
- +100 XP
- Beginner → Intermediate
- INVESTIGATE
#048 · CLOUD SECURITY
NEWExposure or Compromise?
A cloud function is reachable from the internet and has broad read permissions.
- ~5 min
- +100 XP
- Intermediate