Atlas Lion - (Cortex XSIAM) - Writeup

Challenge Overview

A Moroccan-linked actor phishes a Microsoft 365 user at Baker Street Labs, harvests the session, signs in from three countries, invites a rogue guest for persistence and starts touching Power Automate. Every answer comes from inside XSIAM case #2753, "Rare Country Login and suspicious phishing site access with multiple SSO resource access", which groups 22 issues against the user bakerstreetlabs\xdrsherlock and the endpoint rangeaiclient01.

---

Answer Ledger

---

The Timeline

Times are as the console displayed them (IST, UTC+5:30), all on 5 February 2026.

---

Q1: Targeted Spear Phishing

The question wants the full URL behind the fake Microsoft re-authentication link. The AURL alert only names the payload domain malicious.com, so it is a distraction here. The phishing link is collected as a URL artifact on the case: open Key Assets & Artifacts → URL. Of the three URLs, w3.org/2000/svg is an SVG namespace and malicious.com/payload.exe is the download, which leaves the typosquatted login page.

Flag: https://login.microsoft-reauth.com/UuKpWmio

---

Q2: Detonating the Evidence

The same email had a second lure, a "Download Security Certificate" button pointing at http://malicious.com/payload.exe. WildFire's verdict is printed in the description of the AURL alert (#20160).

Flag: ransomware

---

Q3: Firewall Policy Classification

The question wants the Advanced URL Filtering category exactly as stored in panw_ngfw_url_raw. The correlation rule behind "Suspicious Phishing Site Access" says it matches NGFW phishing alerts, which tells you the category but not its exact label. Querying the dataset gives the label:

dataset = panw_ngfw_url_raw
| filter url_domain contains "microsoft-reauth" or url_domain contains "office"
| comp count() as catgs by url_category, url_domain
| sort desc catgs

The short PAN-DB name phishing was rejected. The flag is the display string the dataset returns.

Flag: Phishing sites

---

Q4: Temporal Anomaly Detection

Open the user's asset page, switch to Activities and scroll to the Issues & Insights Heatmap. On the Thu 02/12 row the busiest cell is hour 5, with five events.

Flag: 05:00,5

---

Q5: Regional Rarity Score

The same user page has a Common User Locations widget. The user is overwhelmingly a US login, with Germany and Israel as the outliers.

Flag: 10.5%

---

Q6: Pattern Matching Urgency

Open the email from the case's email node to get the Email Overview. With Summary Highlight on, XSIAM tags the phrases its content analytics matched. The three under Urgency are the answer; the three under Account Notifications are distractors.

Flag: URGENT, 60 minutes, temporary lock

---

Q7: Brute Force Attribution

Every row in the user's activity timeline came from 209.133.103.146, so the IP was obvious early. The count was not. The Authentication Attempts table stops at exactly 100 rows, all from one day, and XQL was degraded during the event.

The real total sits in Identity Analytics: open the Impossible Traveler issue, click the user node in the investigation graph, choose Hosts Authenticated From and sort by count.

A UI table that returns exactly 100 rows is a display cap, not a count.

Flag: 209.133.103.146:3096

---

Q8: Adversary Pattern Mapping

Searching the sender address over the last 30 days moves from one incident to the campaign. The MITRE ATT&CK breakdown shows Phishing for Initial Access, Exfiltration Over Alternative Protocol, and a single Impact technique across 54 issues.

Flag: Financial Theft

---

Q9: Threat Actor Infra Hunting

The remote IP in both "Suspicious Phishing Site Access" alerts is 170.187.158.212. Clicking it in Key Assets & Artifacts opens its card with WhoIs data from the platform's own threat intelligence. Use that record exactly as shown; a public registry lookup returns a broader parent block.

Dead end: 54.240.27.225 is Amazon SES, the server that sent the email, not the attacker's staging host.

Flag: Akamai Technologies, Inc./170.187.144.0 - 170.187.159.255

---

Q10: Impossible Traveler Identity Analytics

The Impossible Traveler issue lists three source IPs. Its own Network Authentication table holds 168 events for the alert window (78 from 89.36.76.100, 41 from 89.138.64.17), but those counts were rejected. The question points at Identity Analytics, which aggregates seven days either side of the alert.

Flag: 94

---

Q11: Persistence Neutralization

The "Rare successful guest invitation" issue (#20195) shows xdrsherlock creating the guest microsoft-reauth_mailslurp.biz#EXT#@bakerstreetlabs.onmicrosoft.com. A display name or UPN can be renamed to something harmless; the Entra object ID cannot. It is the Cloud Referenced Resource on the alert row.

Flag: 5cfba311-c28f-4b5e-8cbe-e1e07072488f

---

Q12: Automated Enrichment Orchestration

The guest invitation issue runs the out-of-the-box "Successful guest user invitation" playbook. Under Work Plan, the Check IOCs Reputation branch starts with task #2, Check IP Reputation, which enriches 86.38.98.9.

A TIM score of 2 means Suspicious.

Flag: 2

---

Takeaways

• Alert descriptions often summarise the wrong thing for the question. The AURL alert named malicious.com, while the credential lure lived in the artifacts.
• Copy labels exactly as the platform stores them: "Phishing sites", not "phishing"; the WhoIs block as XSIAM shows it, not as a public registry does.
• Counts belong to aggregations. Capped tables and per-alert event lists undercount; Identity Analytics and XQL comp do not.
• Pin persistence to immutable identifiers. The guest's object ID survives any rename.