Search

Detecting External Remote Services

Detect and investigate malicious RMM tool abuse for persistence on Windows.

medium

Node2Shell: CVE-2026-111497

Exploit Node.js's Brotli decoder flaw (CVE-2026-111497) for RCE, then detect and patch it.

medium

Attacking Enterprise Wi-Fi

Capture, crack, and relay 802.1X credentials to break into WPA-Enterprise networks.

hard

Detecting Persistent Account Manipulation

Explore how threat actors manipulate accounts for persistence and how to detect and respond to it.

medium

Operation Reroute

Can you intercept traffic from another ISP?

hard

Day-O

A process left traces in memory. Analyze the evidence and uncover what the malware was set to do.

medium

Strange & Unusual Activity

Something is hiding in the network traffic. Hunt through Zeek logs and uncover what slipped through.

medium

Dead Endpoint

A photo gallery went dark. Trace the compromise on the Linux disk and recover the locked images.

hard

The Waiting Room

A supplier email hides an odd attachment. Follow the evidence and find what left the workstation.

medium

Handbook for the Recently Compromised

Trace an intrusion through Windows event logs and uncover what happened on the workstation.

easy

PHP2Shell

Exploit the PHP2Shell runtime CVEs via session.upload_progress for unauthenticated RCE.

easy

Detecting Persistent WMI Consumers

Learn how attackers abuse WMI for persistence and detect it with event logs and forensic artefacts.

medium

Detecting Persistent Malicious Services

Explore how threat actors abuse Windows Services for persistence and how to detect it.

medium

Attacking WPA3 and Rogue Access Points

Downgrade WPA3 clients and abuse rogue access points to capture and crack Wi-Fi handshakes.

hard

Detecting Persistent AutoStart Run Keys

Discover how threat actors abuse AutoStart Run keys for persistence and how to detect it.

medium

The Finance Trail

THM Security Services has been engaged for a SOC Analysis activity for Vantara Financial Group.

medium

Detecting Persistent Scheduled Tasks

Discover how threat actors abuse Scheduled Tasks for persistence and how to detect this abuse.

medium

Threat Hunting Simulator: Health Hazard

Learn how the Threat Hunting Simulator works by playing your first scenario, from the hypothesis to the final report.

easy

SOC Simulator: Introduction to Phishing

Play your first SOC Simulator scenario and learn to triage phishing alerts, one alert at a time.

easy

Live Detection With LOKI and THOR

Apply YARA-based detection with LOKI and THOR to catch active threats.

medium

Attacking Open and WPA2-PSK Networks

Bypass a captive portal, then capture, crack and decrypt a WPA2 handshake.

medium

Investigating Script-Based Executions

Learn how attackers abuse legitimate scripting engines for intrusion, then investigate the evidence.

medium

Jackpot

No card. No PIN. No transaction. Teach the machine to empty itself.

medium