Blue Team Labs

Investigate a PHP2Shell attack in this hands-on network forensics lab. Analyze IDS alerts, network traffic and web server logs to reconstruct the attack timeline, trace post-exploitation activity and distinguish attacker behavior from incident-response activity.

One installer looked just like the rest. By the time the damage was done, there was almost nothing left to investigate. Almost.

Apply MISP to manage security events, create attributes, and integrate threat intelligence from data feeds.

Analyze a malware campaign using MISP to identify communication patterns and extract key indicators of compromise (IOCs), including malware family and file hashes.

Investigate a targeted espionage intrusion from delivery through to command-and-control: unpack a disguised container, rebuild the payload hidden inside it, reverse the Go implant it drops, and turn the operator's leftovers into attribution.

An aviation contractor's developer installed a database tool from the top search result. Reconstruct the full intrusion from a single capture, from the lure domain through the implant's tasking to the second stage pulled down in cleartext.

Correlate forensic artifacts from event logs, browser history, and prefetch with static analysis using IDA Pro to reconstruct a BYOVD attack chain and defense evasion tactics.

Correlate Android and Windows forensic artifacts, including logs and malware analysis, to reconstruct a multi-stage BYOD breach from initial access to persistence.

Utilize OSINT, VirusTotal, and crt.sh to analyze a multi-stage malvertising campaign, identifying initial access, malware payloads, and attacker infrastructure.

Reconstruct an intrusion timeline by analyzing event logs, registry, file system, and network artifacts to identify attacker TTPs and data exfiltration.

Investigate a multi-stage supply-chain intrusion that landed via a poisoned npm dependency and pivoted through CI/CD into production and AWS by pivoting across Splunk, disk images, and git history.

Correlate Splunk logs and host forensic artifacts from triage images to reconstruct a multi-stage TeamCity compromise and identify attacker TTPs.