Scenario simulation

Macro document leads to a PowerShell loader and C2 beacon.

Attack chain

1. 1Macro-enabled attachment opened
2. 2Encoded PowerShell loader executes
3. 3C2 beacon established

You'll practise

• Recognise Office-spawns-shell as a detection signal
• Pivot from process telemetry to network IOCs
• Decide when isolation is warranted

Distributed authentication failures against the identity provider.

Attack chain

1. 1Low-and-slow failures across many accounts
2. 2One account succeeds
3. 3Attacker signs in without MFA

You'll practise

• Spot a spray pattern vs. normal failed-logon noise
• Identify which account(s) actually succeeded
• Scope conditional-access gaps

Valid account abuse, inbox rules and data staging.

Attack chain

1. 1Sign-in from an unfamiliar ASN
2. 2Hiding inbox rule created
3. 3Bulk file access staged for exfiltration

You'll practise

• Correlate an anomalous sign-in with follow-on mailbox changes
• Recognise inbox-rule abuse as a BEC precursor
• Judge exfiltration risk from access volume alone

Shadow copy deletion, mass encryption and containment under pressure.

Attack chain

1. 1Canary files renamed in bulk
2. 2Shadow copies deleted
3. 3Ransom note dropped

You'll practise

• Act on canary-file tampering before encryption completes
• Run the ransomware containment playbook under time pressure
• Balance eradication speed against evidence preservation

Unusual data access followed by upload to personal cloud storage.

Attack chain

1. 1Overnight bulk file access
2. 2Matching-volume outbound upload
3. 3Destination is unsanctioned personal storage

You'll practise

• Distinguish legitimate bulk access from staged exfiltration
• Correlate access volume with outbound transfer volume
• Handle a case that needs HR/legal, not just technical response

Upload endpoint abuse leading to command execution.

Attack chain

1. 1Script uploaded via a public form
2. 2File requested directly from the web root
3. 3Worker process spawns a shell

You'll practise

• Trace a web-root file write back to the vulnerable endpoint
• Recognise command execution from an application-tier process
• Scope other upload endpoints with the same gap

Lookalike-domain invoice fraud targeting accounts payable.

Attack chain

1. 1Lookalike domain registered
2. 2Urgent bank-detail-change email sent
3. 3Accounts payable asked to redirect a real invoice

You'll practise

• Spot a lookalike sending domain by eye and by header analysis
• Apply out-of-band verification before financial impact occurs
• Write a warning that a non-technical audience will actually read

Breached-credential replay against the customer-facing portal.

Attack chain

1. 1Automated login attempts from a breach corpus
2. 2A small percentage succeed
3. 3Successful sessions require follow-up

You'll practise

• Separate automation traffic from real customer logins
• Prioritise response by success rate, not raw volume
• Recommend a durable control (rate limiting, CAPTCHA), not just a one-time reset

Bulk repository access and a USB device before a resignation takes effect.

Attack chain

1. 1Resignation submitted
2. 2Overnight bulk repository pull
3. 3USB mass storage device attached

You'll practise

• Weigh HR context (a resignation) alongside technical signal
• Decide when to suspend access pending review
• Hand off evidence correctly for HR/legal, not just close the alert

A storage bucket ACL flips to public and gets scraped within minutes.

Attack chain

1. 1Bucket ACL changed to public read
2. 2Internet-wide scanners discover it
3. 3Objects listed and downloaded

You'll practise

• Read cloud audit-log API calls (PutBucketAcl, GetObject) like any other telemetry
• React fast enough to matter — public buckets get scraped in minutes
• Recommend a preventive guardrail, not just a fix

A typosquatted dependency runs code on the build agent.

Attack chain

1. 1Typosquatted package pulled by auto-update
2. 2Post-install script executes
3. 3Build agent beacons out

You'll practise

• Trace impact from a dependency to a running process to a network connection
• Decide what else the build agent's secrets can now reach
• Balance pipeline availability against a compromised-agent rebuild

Volumetric flood against the public web tier degrades real traffic.

Attack chain

1. 1Request volume spikes ~40x baseline
2. 2Sources span hundreds of IPs/ASNs
3. 3Legitimate traffic starts timing out

You'll practise

• Distinguish a real DoS from a traffic spike or a bad deploy
• Engage the right response (scrubbing, scaling) instead of manual triage
• Communicate availability impact to stakeholders under time pressure

An unsigned miner quietly pegs CPU on build infrastructure.

Attack chain

1. 1Unsigned binary launched via scheduled task
2. 2Sustained near-100% CPU
3. 3Outbound connection to a mining pool

You'll practise

• Recognise resource-hijacking as an impact technique, not just a performance issue
• Trace a scheduled task back to its origin
• Verify no other hosts share the same indicator

Exposed RDP is brute-forced, then reused for lateral movement.

Attack chain

1. 1Thousands of RDP auth failures
2. 2One account succeeds
3. 3RDP session opened to a second internal host

You'll practise

• Set a sane threshold for a brute-force alert
• Recognise reused-credential lateral movement immediately after compromise
• Recommend removing internet-exposed RDP, not just resetting the password