Blue Team Labs

Investigate a PHP2Shell attack in this hands-on network forensics lab. Analyze IDS alerts, network traffic and web server logs to reconstruct the attack timeline, trace post-exploitation activity and distinguish attacker behavior from incident-response activity.

Analyze network traffic to identify malware delivery, deobfuscate scripts, and map attacker techniques using MITRE ATT&CK, focusing on stealthy execution and reflective code loading.

Investigate a targeted espionage intrusion from delivery through to command-and-control: unpack a disguised container, rebuild the payload hidden inside it, reverse the Go implant it drops, and turn the operator's leftovers into attribution.

Investigate a multi-stage supply-chain intrusion that landed via a poisoned npm dependency and pivoted through CI/CD into production and AWS by pivoting across Splunk, disk images, and git history.

Trace the attack chain from phishing delivery through obfuscated JavaScript, PowerShell loaders, and final payload execution.

A disgruntled customer, a compromised survey, and a trail of evidence hiding in plain sight — can you trace the attack from the first click to the final payload?

Analyze a web server compromise by analyzing network traffic to trace a Java deserialization exploit and the subsequent deployment of a Cobalt Strike beacon.