Blue Team Labs

Put your knowledge into practice with gamified cyber security challenges.

Join for Free

CorporateSecrets

Endpoint Forensics

medium

Evaluate a Windows disk image by correlating registry, event log, browser, and MFT artifacts to reconstruct evidence of corporate secret exfiltration.

Hunter

Endpoint Forensics

medium

Evaluate forensic artifacts from a disk image to confirm unauthorized port scanning and assess user intent for installing illegal applications.

DeadDrop - Hollow

PREMIUMNew

Threat Hunting, Endpoint Forensics

hard

Investigate a hybrid cloud + on-prem intrusion using Splunk, triage disk and memory images across three hosts: trace a phished finance workstation through DLL side-loading, Kerberoasting and in-memory shellcode, follow lateral movement over WinRM to a Domain-Controller-impersonating AD CS certificate, and uncover a covert Microsoft Graph calendar dead-drop C2 that leaves no network signature.