CyberStrike Arena — Scenario Review

Welcome back, Reviewer

Select a Scenario

Select a scenario to review. Read through the full scenario, questions, and evidence guide — then submit your feedback.

Platform Overview

⚡ Scoring

5 attempts per question. Attempt 1: 100% · Attempt 2: 75% · Attempt 3: 50% · Attempt 4: 25% · Attempt 5: 10% · All wrong: 0% (answer revealed). Difficulty weighted: Easy 1× · Medium 1.5× · Hard 2×.

🛡 Integrity

Session focus is monitored throughout and flagged at 4 severity levels.

🏅 Domain Fit

Each participant assigned SOC, CTI, or DFIR based on highest department score.

📋 Rules

All evidence is provided within the session. Minimise browser to access investigation tools. No answer sharing.

⏱ Timer

Countdown enforced per scenario. Unanswered questions lock on expiry.

📊 Reporting

Full results shared after session closes. PDF and CSV export available.

Select a Scenario to Review

SCENARIO A

Operation SilverTrap

★★★☆☆ Intermediate

A financial sector workstation is targeted via credential-based access. A disguised payload is deployed using a trusted system binary. Three persistence mechanisms are installed before the attacker moves to an internal server.

QUESTIONS

SUB-Q

4hr

TIMER

SCENARIO B

Operation IronVeil

★★★★☆ Advanced

A sophisticated multi-stage attack targeting multiple systems. Credential dumping, domain compromise, privilege escalation, and access to a critical financial terminal. Full kill chain reconstruction required.

QUESTIONS

SUB-Q

6hr

TIMER

💬

Questions about the scenarios?

We would appreciate it if managers could complete their review and share their feedback. You can save progress and return at any time.

Email: support@cyber-strike.cc

🔍 Kibana SIEM — Participant View SOC Questions

Participants write KQL queries against pre-loaded scenario logs to find evidence and answer SOC questions. Read-only access.

elastic

Kibana 8.x

Security

🛡 Alerts

📊 Dashboards

🔍 Discover

🕐 Timeline

Investigate

🌐 Network

💻 Hosts

event.code: "4625" AND user.name: "sarah.ahmed" AND @timestamp: [2026-06-18T02:13:00 TO 2026-06-18T02:14:00]

47 hits · index: security-events-* · host: WS-TELLER-04

@timestamp

event.code

user.name

event.outcome

💡 Example KQL queries for SOC questions

SOC-1 Q1: event.code:"4625" AND user.name:"sarah.ahmed" → 47 hits
SOC-2 Q2: process.name:"certutil.exe" AND event.code:"4104" → LOLBin
SOC-3 Q1: destination.ip:"91.108.56.12" → C2 traffic

🧠 CTI Workbench — Participant View CTI Questions

Participants submit IOCs for enrichment, map TTPs on ATT&CK Navigator, and download threat intel reports. Each action generates a Report ID as answer proof.

Submit IOC

91.108.56.12

Enrich

Submitted IOCs

IPv4

91.108.56.12

● Malicious · Score 94

Domain

silver-update-srv[.]net

● Malicious · Score 91

SHA256

a1b2c3d4…

● Malicious · Themida

Intel Reports

TA2101 Campaign Q1 2026

PDF · 2.4MB · ↓ Download

SilverTrap Malware Analysis

PDF · 1.1MB · ↓ Download

SWIFT Attack Patterns 2026

PDF · 3.2MB · ↓ Download

IOC Enrichment

ATT&CK Navigator

Threat Actor

91.108.56.12 — Enrichment Report

Malicious

Threat Score · Known C2 Infrastructure

ASN: AS62041 · TA2101 infrastructure

First seen: 2025-11-14 · 38/89 AV detections

Malware Family

SilverTrap C2

Packer

Themida (commercial)

Hosting

Bulletproof VPS

Attribution

TA2101 · 67%

Report ID: WB-2026-ST-0047 ⇭ Copy as answer proof

ATT&CK Navigator — 6 techniques mapped · Layer ID: NAV-ST-001

T1078
Valid Acct
T1105
Ingress
T1547
Run Key
—
T1027
Pack
T1021
SMB
T1071
Web

💻 DFIR VM — Participant View DFIR Questions

Participants download a pre-compromised Windows VM. All forensic tools pre-installed. Evidence in C:\Evidence\ organized by category.

Investigation Environment

DFIR Virtual Machine

Pre-compromised Windows image with all artifacts and forensic tools ready. Participants download the OVA, import into VirtualBox or VMware, and begin investigation immediately.

WS-TELLER-04 — Investigation Image

Windows 10 x64

Format

OVA / VMDK

State

Post-compromise

Size

~18 GB

📁 C:\Evidence\

All artifacts pre-organized by category

📁

Malware\

svchostx.exe · goldwire.xlsm

DFIR-1

📁

Prefetch\

SVCHOSTX.EXE-AB12CD.pf

DFIR-1

📁

Registry\

NTUSER.DAT · SYSTEM · SOFTWARE

DFIR-2

📁

Logs\

Security.evtx · System.evtx

DFIR-3

📁

Memory\

ls.dmp (847MB) — IronVeil only

Advanced

🔧 Pre-installed Forensic Tools

All tools available on the desktop

PECmd

Prefetch analysis · first run · run count

DFIR-1

PEStudio

PE analysis · strings · packer detection

DFIR-1

Autoruns

Persistence mechanisms · registry · tasks

DFIR-2

RegRipper

Registry hive parsing · Run keys · MRU

DFIR-2

Event Viewer

EVTX logs · Security · System audit

DFIR-3

Volatility 3

Memory forensics · process · credentials

IronVeil

⚡ Investigation Flow

Follows SOC escalation into DFIR

Download OVA file

Import into VirtualBox or VMware

Boot VM

Already in post-compromise state

Open C:\Evidence\

All artifacts pre-organized by DFIR question

Run forensic tools

Use pre-installed tools to analyse artifacts

Answer + upload screenshots

Submit tool output as evidence proof

🔗

Linked to SOC Investigation

DFIR-3 requires both the VM and Kibana. Findings from SOC questions feed directly into DFIR — same machine, deeper investigation. This mirrors the real-world SOC → DFIR escalation workflow.

Loading dashboard…