/Cybersecurity
Boogeyman 3:WALKTHROUGH
Due to the previous attacks of Boogeyman, Quick Logistics LLC hired a managed security service provider to handle its Security Operations Center. Little did they know, the Boogeyman was still…
Topic
Blue Team
40 posts on this topic.
/CybersecurityBoogeyman 2:WALKTHROUGH
After having a severe attack from the Boogeyman, Quick Logistics LLC improved its security defences. However, the Boogeyman returns with new and improved tactics, techniques and procedures. In this…
/CybersecurityBoogeyman 1: WALKTHROUGH
Uncover the secrets of the new emerging threat, the Boogeyman. In this room, you will be tasked to analyse the Tactics, Techniques, and Procedures (TTPs) executed by a threat group, from obtaining…
/CybersecurityTempest: WALKTHROUGH
This room aims to introduce the process of analysing endpoint and network logs from a compromised asset. Given the artefacts, we will aim to uncover the incident from the Tempest machine. In this…
- /Cybersecurity
Phishing Prevention: WALKTHROUGH
There are various actions a defender can take to help protect the users from falling victim to a malicious email. Some examples of these actions are listed below: Email Security (SPF, DKIM, DMARC)…
- /Cybersecurity
Phishing Analysis Tools: WALKTHROUGH
Remember from Phishing Room 1; we covered how to manually sift through the email raw source code to extract information. In this room, we will look at various tools that will aid us in analyzing…
- /Cybersecurity
Phishing Emails in Action
As this room’s answers are all in the readings there won’t be any screenshots in this writeup. just look closely! Now that we covered the basics concerning emails in Phishing Emails 1, let's dive…
- /Cybersecurity
Phishing Analysis Fundamentals
Spam and Phishing are common social engineering attacks. In social engineering, phishing attack vectors can be a phone call, a text message, or an email. As you should have already guessed, our…
- /Cybersecurity
Secret Recipe: WALKTHROUGH
Storyline Jasmine owns a famous New York coffee shop Coffely which is famous city-wide for its unique taste. Only Jasmine keeps the original copy of the recipe, and she only keeps it on her work…
- /Cybersecurity
Critical: WALKTHROUGH
Incident Scenario Our user "Hattori" has reported strange behavior on his computer and realized that some PDF files have been encrypted, including a critical document to the company named…
- /Cybersecurity
Velociraptor: WALKTHROUGH
Velociraptor In this room, we will explore Rapid7's newly acquired tool known as Velociraptor. Per the official Velociraptor documentation, "Velociraptor is a unique, advanced open-source endpoint…
- /Cybersecurity
Disgruntled: WALKTHROUGH
Hey, kid! Good, you’re here! Not sure if you’ve seen the news, but an employee from the IT department of one of our clients (CyberT) got arrested by the police. The guy was running a successful…
/CybersecurityUnattended: WALKTHROUGH
Welcome to the team, kid. I have something for you to get your feet wet. Our client has a newly hired employee who saw a suspicious-looking janitor exiting his office as he was about to return from…
- /Cybersecurity
Intro to Malware Analysis
Every once in a while, when you are working as a SOC analyst, you will come across content (a file or traffic) that seems suspicious, and you will have to decide whether that content is malicious or…
- /Cybersecurity
TheHive Project
Welcome to TheHive Project Outline! This room will cover the foundations of using the TheHive Project, a Security Incident Response Platform. Specifically, we will be looking at: What TheHive is? An…
- /Cybersecurity
Kape: WALKTHROUGH
Revisiting Windows Forensics In the Windows Forensics 1 and Windows Forensics 2 rooms, we learned about the different artifacts which store information about a user's activity on a system. We also…
- /Cybersecurity
Windows Forensics 2:WALKTHROUGH
Introduction We learned about Windows Forensics in the previous room and practiced extracting forensic artifacts from the Windows Registry. We learned about gathering system information, user…
- /Cybersecurity
Windows Forensics 1: WALKTHROUGH
Introduction to Computer Forensics for Windows: Computer forensics is an essential field of cyber security that involves gathering evidence of activities performed on computers. It is a part of the…
/CybersecurityDFIR An Introduction: WALKTHROUGH
Learning Objectives Security breaches and incidents happen despite the security teams trying their best to avoid them worldwide. The prudent approach in such a scenario is to prepare for the time…
- /Cybersecurity
Benign: WALKTHROUGH
We will investigate host-centric logs in this challenge room to find suspicious process execution. To learn more about Splunk and how to investigate the logs, look at the rooms splunk101 and…
- /Cybersecurity
Investigating With Splunk: WALKTHROUGH
SOC Analyst Johny has observed some anomalous behaviours in the logs of a few windows machines. It looks like the adversary has access to some of these machines and successfully created some…
- /Cybersecurity
Splunk Incident Handling: WALKTHROUGH
This room covers an incident Handling scenario using Splunk. An incident from a security perspective is "Any event or action, that has a negative consequence on the security of a user/computer or an…
- /Cybersecurity
Splunk:Basics: WALKTHROUGH
Splunk is one of the leading SIEM solutions in the market that provides the ability to collect, analyze and correlate the network and machine logs in real-time. In this room, we will explore the…
/CybersecurityItsyBitsy (ELK): WALKTHROUGH
In this challenge room, we will take a simple challenge to investigate an alert by IDS regarding a potential C2 communication. Room Machine Before moving forward, deploy the machine. When you deploy…
- /Cybersecurity
ELK 101: WALKTHROUGH
In this room, we will learn how to utilize the Kibana interface to search, filter, and create visualizations and dashboards, while investigating VPN logs for anomalies. This room also covers a brief…
- /Cybersecurity
Challenge:Monday Monitor: WALKTHROUGH
Scenario Swiftspend Finance, the coolest fintech company in town, is on a mission to level up its cyber security game to keep those digital adversaries at bay and ensure their customers stay safe…
- /Cybersecurity
Layer 2 Security:LAB
DHCP Snooping, Dynamic ARP inspection, Port Security Exercise 4 - Configuring Layer 2 Security Features Sometimes a network could have traffic that is malicious. These types of traffic cannot be…
- /Cybersecurity
SIEM: NOTES
What is SIEM SIEM stands for Security Information and Event Management system. It is a tool that collects data from various endpoints/network devices across the network, stores them at a centralized…
- /Cybersecurity
Wazuh: WALKTHROUGH
Created in 2015, Wazuh is an open-source, freely available and extensive EDR solution. It can be used in all scales of environments. Wazuh operates on a management and agent module. Simply, a device…
- /Cybersecurity
Endpoint Security: NOTES
Wazuh Wazuh is an open-source, freely available, and extensive EDR solution, which Security Engineers can deploy in all scales of environments. Wazuh operates on a management and agent model where a…
- /Cybersecurity
TShark: NOTES
TShark is an open-source command-line network traffic analyser. It is created by the Wireshark developers and has most of the features of Wireshark. It is commonly used as a command-line version of…
- /Cybersecurity
Wireshark (Defensive)
Capture Filter Syntax These filters use byte offsets hex values and masks with boolean operators, and it is not easy to understand/predict the filter's purpose at first glance. The base syntax is…
- /Cybersecurity
Brim: NOTES
Brim vs Wireshark vs Zeek While each of them is powerful and useful, it is good to know the strengths and weaknesses of each tool and which one to use for the best outcome. As a traffic capture…
- /Cybersecurity
Ubuntu Zeek: NOTES
CategoryCommand Purpose and UsageCategoryCommand Purpose and UsageBasicsView the command history:ubuntu@ubuntu$ history Execute the 10th command in history: ubuntu@ubuntu$ !10 Execute the previous…
- /Cybersecurity
OpenCTI: NOTES
What is OpenCTI and how is it used? How would I navigate through the platform? What functionalities will be important during a security threat analysis? Cyber Threat Intelligence is typically a…
- /Cybersecurity
OSINT Tools: NOTES
Using UrlScan.io to scan for malicious URLs. Using Abuse.ch to track malware and botnet indicators. Investigate phishing emails using PhishTool Using Cisco's Talos Intelligence platform for intel…
- /Cybersecurity
CTI: NOTES
Cyber Threat Intelligence (CTI) can be defined as evidence-based knowledge about adversaries, including their indicators, tactics, motivations, and actionable advice against them. These can be…
- /Cybersecurity
UKC: NOTES
Threat modelling, in a cybersecurity context, is a series of steps to ultimately improve the security of a system. Threat modelling is about identifying risk and essentially boils down to…
- /Cybersecurity
MISP: NOTES
MISP - MALWARE INFORMATION SHARING PLATFORM MISP (Malware Information Sharing Platform) is an open-source threat information platform that facilitates the collection, storage and distribution of…
- /Cybersecurity
Cyber Kill Chain: NOTES
Reconnaissance is discovering and collecting information on the system and the victim. The reconnaissance phase is the planning phase for the adversaries. OSINT (Open-Source Intelligence) also falls…