Archive · Training log
Labs & Courses
Hands-on labs and training programs completed.
Training courses
CyberDefenders labs
38 completed challengessyncing…
Lockdown
Reconstruct a multi-stage intrusion by analyzing network traffic, memory, and malware artifacts using Wireshark, Volatility, and VirusTotal, mapping findings to MITRE ATT&CK.
easyNetwork ForensicsXWorm
Analyze malware behavior to identify persistence methods, evasion techniques, and C2 infrastructure by extracting artifacts and configuration data from static and dynamic analysis.
mediumMalware AnalysisHawkEye
Reconstruct a HawkEye Keylogger data exfiltration incident by analyzing network traffic with Wireshark and CyberChef, identifying IoCs and stolen credentials.
mediumNetwork ForensicsOpenWire
Investigate a Java deserialization vulnerability in Apache ActiveMQ that enables remote code execution through insecure class loading.
mediumNetwork ForensicsMalDoc101
Analyze obfuscated scripts to identify malicious infrastructure, specifically extracting the first FQDN used to download a trojan.
mediumMalware AnalysisFakeGPT
Analyze a malicious Chrome extension's code and behavior to identify data theft mechanisms, covert exfiltration, and anti-analysis techniques.
easyMalware AnalysisObfuscated
Deobfuscate multi-stage VBA and JavaScript malware from a Word document, extracting IOCs and reconstructing execution flow.
mediumMalware AnalysisBRabbit
Reconstruct a Bad Rabbit ransomware attack chain by analyzing phishing, persistence, and MBR modification using dynamic analysis and MITRE ATT&CK.
mediumThreat IntelRotaJakiro
Reverse engineer and analyze RotaJakiro Linux malware using Ghidra, strace, and Wireshark to identify persistence, anti-analysis, and C2 mechanisms.
hardMalware AnalysisSilent Breach
Analyze a forensic image to extract communication artifacts, identify malware behavior, and decrypt encrypted files.
mediumEndpoint ForensicsSolarDisruption
Investigate PLC network traffic and system logs to identify insider manipulation attempts and determine the cause of the solar panel disruption.
hardNetwork ForensicsTusk Infostealer
Analyze threat intelligence and malware configuration to identify TTPs, extract IOCs, and track cryptocurrency flow of the Tusk Infostealer campaign.
easyThreat IntelPacketDetective
Analyze network traffic in PCAP files using Wireshark to extract IOCs and reconstruct attacker tactics like authentication and remote execution.
easyNetwork ForensicsTomcat Takeover
Analyze network traffic using Wireshark to identify suspicious web server administration access and potential compromise.
easyNetwork ForensicsPaloAltoRCE - UTA0218
Reconstruct a Palo Alto RCE attack timeline by analyzing firewall logs in ELK, identifying initial access, reverse shell, persistence, and data exfiltration.
hardThreat HuntingXLMRat
Analyze network traffic to identify malware delivery, deobfuscate scripts, and map attacker techniques using MITRE ATT&CK.
easyNetwork ForensicsReveal
Reconstruct a multi-stage attack by analyzing Windows memory dumps using Volatility 3, identifying malicious processes and command lines.
easyEndpoint ForensicsWeb Investigation
Examine network traffic with Wireshark to investigate web server compromise, identify SQL injection, extract attacker credentials, and detect uploaded malware.
easyNetwork ForensicsAsyncRAT
Dissect a multi-stage AsyncRAT infection exploring obfuscation techniques, payload extraction, persistence mechanisms, and steganographic methods.
mediumMalware AnalysisMeteorHit - Indra
Reconstruct a wiper malware attack by analyzing registry, event logs, and USN journal artifacts using Registry Explorer and Event Log Explorer.
mediumEndpoint ForensicsAndroidBreach
Analyze an Android device dump and reverse engineer a malicious APK using ALEAPP and JADX-GUI to identify malware functionality and data exfiltration.
mediumEndpoint ForensicsIcedID
Investigate IcedID malware using VirusTotal and threat intelligence platforms to identify IOCs, associated threat actors, and execution mechanisms.
easyThreat IntelGrabThePhisher
Analyze a cryptocurrency phishing kit to identify exfiltration methods, extract critical IOCs, and gather threat actor intelligence.
easyThreat IntelRamnit
Analyze a memory dump using Volatility to identify a malicious process, extract network IOCs, file hash, and compilation timestamp.
easyEndpoint ForensicsInsider
Analyze Linux disk image artifacts, including logs and Bash history, using FTK Imager to investigate insider threat activities.
easyEndpoint ForensicsDanaBot
Analyze network traffic using Wireshark to identify DanaBot initial access, deobfuscate malicious JavaScript, and extract IOCs.
easyNetwork Forensics3CX Supply Chain
Reconstruct the 3CX supply chain attack by analyzing compromised MSI and DLL artifacts to identify TTPs and attribute the incident.
easyThreat IntelRed Stealer
Analyze a suspicious executable using VirusTotal and MalwareBazaar to extract IOCs, identify C2 infrastructure, and MITRE ATT&CK techniques.
easyThreat IntelPsExec Hunt
Analyze SMB traffic in a PCAP file using Wireshark to identify PsExec lateral movement, compromised systems, and user credentials.
easyNetwork ForensicsThe Crime
Utilize ALEAPP to analyze Android device artifacts, reconstructing a victim's financial details, movements, and communication patterns.
easyEndpoint ForensicsAmadey - APT-C-36
Reconstruct Amadey Trojan behavior by analyzing memory dumps with Volatility3 to identify malicious processes and persistence mechanisms.
easyEndpoint ForensicsYellow RAT
Analyze malware artifacts using threat intelligence platforms like VirusTotal to identify IOCs, C2 servers, and adversary tactics.
easyThreat IntelPoisonedCredentials
Analyze network traffic for LLMNR/NBT-NS poisoning attacks using Wireshark to identify the rogue machine and compromised accounts.
easyNetwork ForensicsOski
Analyze a sandbox report using Any.Run to identify Stealc malware behavior, extract configuration details, and map tactics to MITRE ATT&CK.
easyThreat IntelWebStrike
Analyze network traffic using Wireshark to investigate a web server compromise, identify web shell deployment and data exfiltration.
easyNetwork ForensicsIntel101
Apply open-source intelligence (OSINT) techniques using Whois, Wayback Machine, and Google Lens to investigate digital footprints.
mediumThreat IntelLespion
Investigate an insider threat by analyzing GitHub repositories for exposed credentials, using OSINT tools to correlate online accounts.
easyThreat IntelRedLine
Employ Volatility to analyze a memory dump, identifying suspicious processes, network IOCs, and attacker C2 infrastructure.
easyEndpoint Forensics