Blue Team Labs
Put your knowledge into practice with gamified cyber security challenges.
PoisonedCredentials
Network Forensics
easyAnalyze network traffic for LLMNR/NBT-NS poisoning attacks using Wireshark to identify the rogue machine, compromised accounts, and affected systems.
PsExec Hunt
Network Forensics
easyAnalyze SMB traffic in a PCAP file using Wireshark to identify PsExec lateral movement, compromised systems, user credentials, and administrative shares.
Oski
Threat Intel
easyAnalyze a sandbox report using Any.Run to identify Stealc malware behavior, extract configuration details, and map observed tactics to MITRE ATT&CK.
AzureHunt
Cloud Forensics
easyCorrelate Azure AD, Activity, and Blob Storage logs in Elastic Stack to reconstruct an attack timeline, identifying initial access, lateral movement, persistence, and data exfiltration.
The Crime
Endpoint Forensics
easyUtilize ALEAPP to analyze Android device artifacts, reconstructing a victim's financial details, movements, and communication patterns.
REvil - GOLD SOUTHFIELD
Threat Hunting
easyAnalyze Sysmon logs in Elastic SIEM to investigate REvil ransomware attack behaviors, decode recovery sabotage commands, and identify IOCs including the C2 onion domain.
Yellow RAT
Threat Intel
easyAnalyze malware artifacts using threat intelligence platforms like VirusTotal to identify IOCs, C2 servers, and understand adversary tactics.
Tomcat Takeover
Network Forensics
easyAnalyze network traffic using Wireshark's custom columns, filters, and statistics to identify suspicious web server administration access and potential compromise.
AWSRaid
Cloud Forensics
easyInvestigate AWS CloudTrail logs using Splunk to identify unauthorized access, analyze configuration changes, and detect persistence mechanisms.
T1110-003
Threat Hunting