Blue Team Labs

Detect, analyze, and respond to Kerberoasting attacks by investigating Kerberos logs, identifying compromised accounts, and uncovering attacker persistence methods.

Analyze Windows event logs in Splunk to identify T1197 BITS abuse, LOLBAS usage, attacker IP, and persistence mechanisms.

Learn to use Splunk for detecting, analyzing, and investigating cybersecurity threats through log analysis, threat hunting, privilege escalation, lateral movement, and advanced attack techniques.

Investigate a simulated multi-stage attack to identify compromise and attacker activity using Elastic SIEM.

Analyze diverse log sources in QRadar SIEM to identify compromised systems, detect malicious tools, and reconstruct the sequence of attack events.

Investigate network attack artifacts by analyzing logs in Kibana to identify compromised systems and incident timelines.

Reconstruct multi-stage attack scenarios by analyzing Splunk logs and integrating OSINT from VirusTotal, ThreatCrowd, and WHOXY to identify TTPs and IOCs.

Investigate a hybrid cloud + on-prem intrusion using Splunk, triage disk and memory images across three hosts: trace a phished finance workstation through DLL side-loading, Kerberoasting and in-memory shellcode, follow lateral movement over WinRM to a Domain-Controller-impersonating AD CS certificate, and uncover a covert Microsoft Graph calendar dead-drop C2 that leaves no network signature.

Investigate a multi-stage supply-chain intrusion that landed via a poisoned npm dependency and pivoted through CI/CD into production and AWS by pivoting across Splunk, disk images, and git history.

The hosting panel is the new front door; chase an attacker from a forged session all the way to root, breaking out of a container and burrowing into the host along the way. By correlating SIEM telemetry, host disk forensics, and network captures across the full intrusion.