Skip to main content

We use cookies to ensure you get the best user experience. For more information see our cookie policy.

1,744 results

AI in the Modern SOC
room

AI in the Modern SOC

Investigate an Elastic alert, then check an AI-prepared Case note against the original events.

easy

Walkthrough
Caido: Core Tools
room

Caido: Core Tools

Master Caido’s core tools: Sitemap, HTTP History, Match & Replace, Replay, Automate, WebSockets.

easy

Walkthrough
Windows IR Summary
room

Windows IR Summary

The end of the Windows IR path and the start of your journey as an incident responder.

easy

Walkthrough
Microsoft ADCS Abuse Detection Challenge
room

Microsoft ADCS Abuse Detection Challenge

Reconstruct an AD CS intrusion from triage evidence alone, with no walkthrough to guide you.

hard

Challenge
IR Report Writing
room

IR Report Writing

Learn how to write a professional IR report for leadership and technical audiences.

easy

Walkthrough
Plaso Timeline Analysis
room

Plaso Timeline Analysis

Learn how Plaso turns a pile of artifacts into one sorted timeline, how to keep that timeline small enough to work with, and how to analyse it in Timeline Explorer.

medium

Walkthrough
Identifying Ransomware Operations
room

Identifying Ransomware Operations

Learn how ransomware operators work and how to identify the group behind an attack from its traces.

medium

Walkthrough
Advanced Velociraptor
room

Advanced Velociraptor

This room covers advanced Velociraptor concepts.

medium

Walkthrough
Velociraptor Basics
room

Velociraptor Basics

Investigate a suspicious Print Spooler alert with Velociraptor and weigh what the evidence shows.

medium

Walkthrough
Kerberoasting and AS-REP Roasting Detection
room

Kerberoasting and AS-REP Roasting Detection

Detect and investigate the two attacks that ask Kerberos for a crackable password hash, and get one.

hard

Walkthrough
Kerberos Tickets
room

Kerberos Tickets

Explore Kerberos authentication mechanics hands-on, from ticket requests to encryption types.

medium

Walkthrough
Microsoft ADCS Abuse Detection
room

Microsoft ADCS Abuse Detection

Detect six Active Directory Certificate Services abuse techniques through forensic evidence.

hard

Walkthrough
Kerberos Delegation Abuse Detection
room

Kerberos Delegation Abuse Detection

Investigate Kerberos delegation abuse from Windows disk and memory forensic artifacts.

hard

Walkthrough
DCSync and DCShadow Attacks Detection
room

DCSync and DCShadow Attacks Detection

Detect and investigate DCSync and DCShadow, the two attacks that impersonate a Domain Controller.

hard

Walkthrough
Identifying Access Token Escalation
room

Identifying Access Token Escalation

Detect access token abuse that escalates attackers to SYSTEM, using event logs and DFIR artifacts.

medium

Walkthrough
Tracing Impact Actions
room

Tracing Impact Actions

Learn how to track attackers' impact actions using log data and artifacts.

medium

Walkthrough
Identifying UAC Escalation Bypass
room

Identifying UAC Escalation Bypass

Detect UAC bypass (T1548.002) in the event logs and disk artifacts of a KAPE triage.

medium

Walkthrough
IR Process at Scale
room

IR Process at Scale

See how incident response varies between a single host and a large AD network.

medium

Walkthrough
Detecting Exfiltration Methods
room

Detecting Exfiltration Methods

Detect data exfiltration via cloud storage, code repositories, messengers, and the blockchain.

medium

Walkthrough
SMB Lateral Movement Analysis
room

SMB Lateral Movement Analysis

Hunt SMB lateral movement across event logs and DFIR artifacts, and learn to prevent and contain it.

medium

Walkthrough
Malicious Drivers and Rootkits Analysis
room

Malicious Drivers and Rootkits Analysis

Investigate Windows kernel drivers and uncover rootkit activity using MemProcFS and Volatility.

medium

Walkthrough
Pass-the-Ticket Attack Detection
room

Pass-the-Ticket Attack Detection

Explore Pass-the-Ticket attack from the blue team perspective.

medium

Walkthrough
Advanced NTFS Analysis
room

Advanced NTFS Analysis

Dive into NTFS internals. Analyze $MFT, $LogFile, $UsnJrnl and ADS to rebuild attacker activity.

medium

Walkthrough
Showing 24 of 1744 results