Blue Team Labs
Put your knowledge into practice with gamified cyber security challenges.
DeadDrop - Hollow
PREMIUMNew
Threat Hunting, Endpoint Forensics
hardInvestigate a hybrid cloud + on-prem intrusion using Splunk, triage disk and memory images across three hosts: trace a phished finance workstation through DLL side-loading, Kerberoasting and in-memory shellcode, follow lateral movement over WinRM to a Domain-Controller-impersonating AD CS certificate, and uncover a covert Microsoft Graph calendar dead-drop C2 that leaves no network signature.
TeamCity Exploit - APT29
PREMIUM
Threat Hunting
insaneCorrelate Splunk logs and host forensic artifacts from triage images to reconstruct a multi-stage TeamCity compromise and identify attacker TTPs.