Friday Mail
Company: Altyn Stroy LLP
Briefing
Altyn Stroy LLP is a construction company. The mailbox buh@altyn-stroy.example received a message apparently from its own department, with an attachment. The recipient did not open it and forwarded the message to you.
There are about fifteen messages in the mailbox that day. No bodies are shown and none are needed: everything required is in the envelope and in the SPF, DKIM and DMARC results.
Be careful with quick conclusions: not every failed check means forgery, and not every passed check means the message is genuine.
Subjects and display names are in Russian, as in the real environment.
Artifacts
The same data as files for real tools: open in Wireshark or Excel, or load into Elastic. The answers match — it is the same data.
Messages · 15
Pick a message to read its headers
Questions
0/7 · 0/115 points
Log in to save your progress and appear on the leaderboard.
Which message failed DMARC?
Format: Message identifier, e.g. m001 · 15 points
Which domain is in the message envelope (Return-Path)?
Format: Domain name · 20 points
Which address did the mail server receive the message from?
Format: IPv4 address · 15 points
What was the SPF result for that message?
Format: One word: pass, fail, softfail or none · 20 points
What is the attachment called?
Format: File name with extension · 15 points
What is the hash of the attachment?
Format: 64 hexadecimal characters · 20 points
Which MITRE ATT&CK technique covers a message with a malicious attachment?
Format: Identifier like T1234.001 · 10 points