Social Engineering & Network Attack Identification
Scenario: You are a SOC/help-desk analyst reviewing a batch of reported
messages, call transcripts, and network logs escalated for triage. Eight items require
classification. For each piece of evidence, identify the specific technique
it most precisely describes. The evidence points to one technique, not several — read
the indicators carefully before selecting.
Instructions: Use the dropdown on each card to classify the attack technique.
When all 8 are answered, click Submit for Grading.
All 8 must be correct to pass and earn completion credit.
Evidence Items
ITEM 01
Help Desk Call — Recorded Transcript (auto-captured by call-recording system)
CALL RECORDING — Ticket #HD-20260627-0841
Timestamp : 2026-06-27 08:41:03 (duration 4m 22s)
Caller ID : +1 (800) 555-0172 [displayed as "MSFT Support"]
Called : ext. 4409 (D. Okafor, Logistics)
TRANSCRIPT (automated speech-to-text, lightly edited):
CALLER : "Good morning, this is Kevin from Microsoft Support. We're seeing
some unusual sign-in activity on your account from an overseas IP. I need
to verify your identity before your access is suspended."
OKAFOR : "Oh — okay, what do you need?"
CALLER : "For security purposes I need the six-digit code that just appeared
on your authenticator app. It's only visible for 30 seconds — please
read it to me now so we can lock out the attacker."
OKAFOR : "It says 7-4-2-1-9-3."
CALLER : "Perfect. One more thing — I'm going to send you a remote-access link
so our engineers can clear the malware. Please install AnyDesk
when it arrives and accept the incoming connection."
OKAFOR : [call ends — user forwarded ticket to security team after colleague
raised concerns]
NOTE: Microsoft has no outbound support line to this org. Caller ID is
spoofable (STIR/SHAKEN not enforced on legacy PSTN trunk).
ITEM 02
Reported SMS — User Mobile (forwarded via Help Desk portal screenshot)
SMS RECEIVED — 2026-06-27 11:14 AM
From: +1 (888) 246-1103 (not in contacts)
USPS ALERT: Your package #9400111899223487221 could not be delivered.
A redelivery fee of $2.99 is required to release your shipment.
Pay now to avoid return to sender:
hxxp://usps-trackfee[.]xyz/redeliver?pkg=9400111899223487221
This link expires in 12 hours.
—————————————————————————
ANALYST NOTE (help desk, received same message on personal device):
- Real USPS tracking URLs use usps.com, NOT usps-trackfee[.]xyz
- Domain usps-trackfee[.]xyz registered 3 days ago (NameCheap, privacy-
shielded, registrant country: CN)
- No package in transit matched this tracking number
- Delivery channel: SMS text message to personal cell
ITEM 03
Reported Email — Finance Dept. (Sarah Kim, Sr. Analyst)
From : David Chen <d.chen@rnicrosoft.com>
To : s.kim@veridian-corp.com (single recipient)
Date : 2026-06-27 09:02:48 UTC
Subject : RE: Project Orion — Revised Invoice for Q3 Reconciliation
Hi Sarah,
Following up on the Project Orion Q3 reconciliation we discussed with
Marcus Webb last Thursday. Marcus asked me to route the updated
invoice directly to you for approval before EOD.
The revised figures are in the document linked below. Please review and
confirm receipt so we can proceed with the board sign-off:
https://veridian-invoice-portal[.]ru/orion-q3-rev2.pdf?token=sk8841
Let me know if you have questions — Marcus has a hard deadline.
Best,
David Chen | Strategic Accounts
Microsoft Corporation
—————————————————————————
Header analysis:
Return-Path : bulk@mailer-syndicate[.]io
SPF : FAIL DKIM : FAIL DMARC : FAIL
Sender domain: rnicrosoft.com (r-n homoglyph for m)
Recipients in To/CC/BCC: 1 (s.kim only — no mass distribution)
OSINT: "Project Orion" and "Marcus Webb" are real internal names
(LinkedIn + company website, publicly visible)
ITEM 04
Reported Email — Office of the CFO (Thomas Reyes, Chief Financial Officer)
From : Eleanor Voss <e.voss@veridian-board-comms[.]net>
To : t.reyes@veridian-corp.com (CFO, single recipient)
Date : 2026-06-27 06:58:11 UTC
Subject : CONFIDENTIAL: Board Resolution — Merger Approval Docs (NDA)
Thomas,
The board concluded its session at 06:00 EST. As chair, I am authorized
to transmit the confidential merger documentation for your sign-off
before the market opens. This matter is under active NDA — do NOT
discuss with legal or IR at this stage.
Please e-sign via the secure portal by 07:30 EST:
https://docusign-secure-portal[.]xyz/board/vdn-merger-2026
Given the sensitivity, I am also requesting you wire $320,000 in
escrow fees to the designated account (instructions in the linked doc)
before 08:00 EST. This is a board-level directive.
Eleanor Voss
Chairwoman, Veridian Corp Board of Directors
—————————————————————————
Header analysis:
Legitimate chair email: e.voss@veridian-board.com (DIFFERENT domain)
Sender domain veridian-board-comms[.]net: registered 6 days ago
SPF : FAIL DKIM : FAIL DMARC : FAIL
Target role: C-suite executive (CFO) — high-value / high-authority target
Theme: confidential M&A + legal urgency + "don't tell anyone"
ITEM 05
Reported Email — Accounts Payable (R. Nguyen, AP Specialist)
From : j.harrison@veridian-corp.com (CEO mailbox — confirmed compromised)
To : r.nguyen@veridian-corp.com (AP Specialist)
Date : 2026-06-27 07:44:09 UTC
Subject : URGENT — Vendor Bank Account Update / Wire Today
Reply-To: james.harrison.ceo@gmail.com (personal Gmail, not corp)
Rachel,
Our vendor Apex Logistics has updated their banking details effective today.
Please wire $48,500 to the new account before noon:
Bank : First National Wire Services
Routing : 021000021
Account : 7741882204
Ref : INV-2026-APX-0441
I am boarding a flight in 20 minutes — do not call me, and do not loop
in finance leadership until the wire confirms. This is time-sensitive.
James
—————————————————————————
ANALYST NOTE:
- No attachment, no link, no malware payload present
- Wire instruction delivered entirely in message body
- CEO mailbox confirmed compromised (inbox rule forwarded replies
to external address; IT detected via audit log)
- "Do not call" instruction designed to prevent out-of-band verify
- Apex Logistics is a real vendor (attacker performed recon first)
ITEM 06
Web Proxy Logs — Multiple Employees (Bluecoat ProxySG export, 2026-06-26)
PROXY ALERT — CrowdStrike Falcon + Bluecoat correlation 2026-06-26
Malicious payload delivery detected from: www.infosec-practitioners-forum[.]org
Category (before compromise): Industry / Security Forum (trusted, bookmarked)
Payload: obfuscated JavaScript injected into forum sidebar —
exploits CVE-2026-1884 (Chrome V8 type confusion, unpatched on 4 hosts)
AFFECTED EMPLOYEES (all visited the same forum on their own initiative):
user: j.tran IP: 10.0.4.12 Visit: 14:07:31 Beacon out: 14:07:44
user: p.osei IP: 10.0.4.31 Visit: 14:09:02 Beacon out: 14:09:17
user: a.kowalski IP: 10.0.4.44 Visit: 14:22:58 Beacon out: 14:23:14
user: m.reyes IP: 10.0.4.61 Visit: 15:01:39 Beacon out: 15:01:52
user: d.smith IP: 10.0.4.77 Visit: 15:14:07 Beacon out: 15:14:23
user: r.okafor IP: 10.0.4.88 Visit: 15:47:49 Beacon out: 15:48:01
COMMON FACTOR: All 6 victims routinely browse infosec-practitioners-forum[.]org
for professional development. No phishing email was sent to these users.
Attackers compromised the LEGITIMATE third-party site, then waited for
the target group to visit organically ("hunt where prey drinks").
C2 beacon destination: 91.213.50.17 (AS-HOSTKEY, NL) — BLOCKED by proxy
ITEM 07
DNS / Proxy Log + WHOIS — Workstation WS-ENG-019 (B. Patel)
DNS QUERY LOG — WS-ENG-019 2026-06-27 10:33:07
Resolver : 10.0.0.53 (internal DNS, no cache poisoning detected)
Query (raw) : rnicrosoft-update[.]com
— Note: user typed URL directly into browser address bar (browser history)
Resolved to : 185.220.101.55 (not a Microsoft IP)
HTTP response : 200 OK — spoofed Windows Update portal served
INTENDED destination (user stated): microsoft.com/en-us/windows/windows-update
ACTUAL typed URL: rnicrosoft-update[.]com (rn homoglyph substitution for m)
Internal DNS returned correct results for microsoft.com:
microsoft.com A 20.236.44.162 (legitimate)
—— DNS cache is CLEAN; no records tampered
WHOIS rnicrosoft-update[.]com:
Registrar : Tucows Domains Inc.
Created : 2026-06-24 (3 days ago)
Registrant : [REDACTED via privacy proxy]
Name servers : ns1.parkingcrew[.]net
AV scan of downloaded "WindowsUpdate.exe": MALICIOUS (trojan dropper)
Root cause: user keystroke error produced the lookalike domain;
DNS infrastructure was NOT compromised — correct domain resolves correctly.
ITEM 08
DNS Resolution Log — Workstation WS-ACCT-007 (K. Flores)
DNS RESOLUTION LOG — WS-ACCT-007 2026-06-27 09:17:44
Browser input (confirmed via history): bankofamerica.com (typed CORRECTLY)
Resolver : 10.0.0.53 (internal forwarder)
LOCAL HOSTS FILE CHECK (/etc/hosts or C:\Windows\System32\drivers\etc\hosts):
91.213.50.88 bankofamerica.com << UNAUTHORIZED ENTRY (injected)
Legitimate BofA IPs: 171.161.x.x / 23.x.x.x (NOT this block)
Resolution returned : 91.213.50.88 (attacker-controlled server, AS-HOSTKEY NL)
TLS cert presented : CN=bankofamerica.com (self-signed, untrusted CA)
Browser warning : HSTS violation / certificate error (user clicked through)
TIMELINE:
09:03 Malware dropper executed (source: phishing email 3 days prior)
09:04 hosts file modified by dropper process (svchost.exe wrapper)
09:17 User navigated to bankofamerica.com — resolved to attacker IP
09:19 Credentials entered on fake login page — exfiltrated to C2
USER TYPED THE CORRECT DOMAIN. Redirect caused by poisoned local hosts record,
not by a user typing error or a compromised upstream DNS server.
Verification
Classify all 8 evidence items correctly to earn completion credit. All 8 must be correct — partial answers do not pass.
0/8
evidence items correctly classified