Blue Team Labs

Investigate a targeted espionage intrusion from delivery through to command-and-control: unpack a disguised container, rebuild the payload hidden inside it, reverse the Go implant it drops, and turn the operator's leftovers into attribution.

Investigate a multi-stage intrusion across six workstations using Velociraptor, correlating artifacts to uncover how the attacker moved, escalated, and stole data before anyone noticed.

Investigate a two-host Linux intrusion using live triage collections and a network capture: analyse authentication, audit and login records, detect a backdoor that never opens a port, statically analyse a stripped ELF implant, and recover data from an encrypted command-and-control channel.

Reconstruct a full-chain ransomware attack that began with a single CVE in the DMZ and ended with domain-wide compromise, data exfiltration, and encrypted file servers.

Reconstruct a multi-stage attack timeline by analyzing forensic artifacts from browser, VSCode, WSL, registry, and application logs.

A routine security audit. A trusted messaging app. By the time the victim realized something was wrong, the damage was already done. Can you trace what happened?

A deal was stolen before it was ever signed. Someone got in, found exactly what they needed, and vanished. Your job is to prove it.

Synthesize diverse forensic artifacts including $MFT, USN journal, and registry hives to reconstruct an anti-forensic intrusion timeline from initial access to exfiltration.

Correlate forensic artifacts from event logs, browser history, and prefetch with static analysis using IDA Pro to reconstruct a BYOVD attack chain and defense evasion tactics.

Analyze Splunk event logs to reconstruct a multi-stage attack chain, detailing initial access, privilege escalation, lateral movement, and data exfiltration.