Northpeak Descent // Operation Brief

Northpeak Descent

Community hunt // an operator held the front door open while everyone watched the noise

Community Hunt Intermediate Sentinel // MDE 18 flags // gate + 5 phases Built by Dogukan Oruc

IR Brief [ Read first ]

// HUNT ASSIGNMENT // Northpeak Descent

From: Hunt Lead // Cyber Range SOC

To: Threat Hunt // On-Shift

Re: Northpeak Logistics // post-intrusion investigation

Someone got into the Northpeak Logistics estate on the evening of 16 June. Multiple footholds, parallel access. The operator held external remote access to the Windows infrastructure and also worked from a Linux host for reconnaissance and tooling. Between roughly 20:00 and 00:30 UTC they moved across the estate, staged tooling, set persistence, beaconed outbound, and reached the crown jewel.

The logs are loud with failed logons, and it looks like a brute-force break-in. Do not take that at face value. The volume is a decoy. The real entry authenticated clean and never tripped a thing.

What we do not yet know:

   · Which foothold came first, and how each host was reached
   · The internal pivot path and method
   · How persistence was configured, and on which host
   · The full C2 infrastructure and how the channel behaved
   · What sensitive data left, and from where

The evidence is in the law-cyber-range Sentinel workspace, MDE tables: DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents, DeviceRegistryEvents, DeviceLogonEvents, DeviceEvents. Discover the schema yourself with take 1 or getschema. Authentication, process, file, registry and network telemetry each live in their own table. Pivot across them.

Filter, or drown. This is a shared workspace. An unfiltered query returns telemetry from estates that are not yours. Scope every query to the Northpeak hosts: where DeviceName has_any ("npt-ws01","npt-srv01","npt-linux01"). If a result looks like fifty other machines, you forgot the filter.

One thing to hold from the start. The obvious story has the operator landing on Linux first and pivoting into Windows. Do not assume it. Put the Windows and Linux entries on one timeline and prove the order yourself. It is not what the shape of the data suggests at a glance.

Work it end to end. Reconstruct the intrusion, every access vector and its source, the pivot, the persistence, the C2, and the theft. Reason where the evidence is thin, some of the strongest findings here are things that did not happen. Then build the chain, entry to pivot to persistence to command-and-control to impact.

Section 00 is a gate. Confirm you are set up on the right workspace before you start. The phrase to submit is in this brief: Northpeak hunter ready. Acknowledge it, then begin.

Get hunting.

// Hunt Lead
Cyber Range SOC · Community hunt built by Dogukan Oruc

Your workspace. All telemetry for this hunt lives in the law-cyber-range Sentinel workspace. Open it, confirm you can query it, and remember the host filter on every query.

→ Open the law-cyber-range workspace

How To Hunt This [ method, not answers ]

A cross-platform intrusion worked end to end, Windows and Linux together. This is method. It will help you, it will not solve it for you.

Filter first, every time. Scope to the Northpeak hosts before you read a single row. An unfiltered result is someone else's estate.

Separate signal from noise. The failed-logon storm is bait. Work only what succeeded, and only from outside.

Prove the order, do not assume it. Two platforms, several footholds. Put them on one timeline and let the timestamps decide which came first.

Pivot on identity and source. One account and one address thread the whole case. When either shows up where it should not, follow it.

Separate the human from the machine. Most of the estate's activity is automation. Learn what the operator's hands-on-keyboard work looks like against the noise.

The network view is not the whole channel. A connection that is not logged still leaves a trace where it was launched. If one console is blind, that blindness is a finding.

Treat absence as evidence. What they did not do matters. No tampering, nothing dropped, reason from the gap to how they stayed quiet.

Then tell the story. The finish is the chain, entry to pivot to persistence to C2 to impact, and what the evidence and its gaps prove.

Hunt Stages [ gate + 5 phases ]

Setup gate — confirm you are on the law-cyber-range workspace. Acknowledge readiness with the phrase from this brief.

Initial access — the real entry, the order of the footholds, the operator's own client, and how the server was reached.

Linux recon & tooling — escalation checks, reachability testing without a scanner, and what they installed to pivot.

Pivot, execution, persistence — the internal hop, the operator's hands-on shells against the noise, and what they planted to survive a reboot.

Command & control — the look-alike channel, the one domain the network saw, the hidden two, and what the rhythm proves.

Impact & judgement — the theft, the session it left in, and the model that let them run this freely without touching the security stack.

Note on the absence. Some of the strongest findings here are things that did not happen. When a table you expect to be busy comes back quiet, that quiet is data, it usually means a stealthier method, not that nothing occurred. Reason from the gap, do not close on it.

// Ready to begin

PLAY THIS HUNT

This is the portfolio copy of the operation brief. The hunt runs live on the Cyber Range.

→ hunt.lognpacific.com/hunt-10-brief

// NORTHPEAK DESCENT //
Community Hunt // Cross-Platform Valid-Account Intrusion
Northpeak Logistics // built by Dogukan Oruc