Blue Team Labs

Synthesize network, document, and malware forensics findings to reconstruct a multi-stage phishing attack, identifying exploit chains and C2 communication.

Reconstruct an end-to-end phishing attack chain by analyzing disk image, registry, application, and browser artifacts using various forensic tools.

Reconstruct a data exfiltration incident by correlating memory, disk, network, and log artifacts using a suite of forensic tools.

Investigate email, document, and network traffic using VirusTotal, oledump, and Wireshark to identify ransomware delivery mechanisms and C2 communications.

Investigate network traffic using Wireshark, NetworkMiner, and Suricata to identify the specific malicious email responsible for system compromise.

Trace a real-world attack chain end to end — from a leaked VPN config to domain-wide ransomware. Along the way you will decode obfuscated malware, reverse-engineer a kernel exploit, crack beacon encryption, and reconstruct the attacker's every move from disk, memory, and network artifacts.

Correlate diverse forensic artifacts to reconstruct a multi-stage ransomware attack, synthesizing insights from BYOVD, custom packer, and anti-analysis techniques.

Investigate a multi-stage LYNX ransomware intrusion across two trusted Active Directory forests in Splunk, then statically analyze the recovered binary to surface developer artifacts and the embedded victim-contact infrastructure.

Hunt browser downloads, MFT records, and Prefetch to unmask the initial dropper and rebuild the attack timeline.