Search

The O365 Intrusion

THM Security Services has been engaged for an Incident Response activity for Vantage Dynamics.

medium

The Agent Took a Shortcut

Reproduce the Sept 2026 OpenAI rogue-agent exploit chain on a health-data portal, then detect it.

medium

Investigating Public-Facing Exploitation

Learn about detecting the exploitation of public-facing applications through log data and artifacts.

medium

Investigating Valid Credentials Abuse

Investigate initial access with valid credentials through log data and forensic artifacts.

medium

Red Queen Protocol

Understand what reverse engineering is and explore different approaches in this guided challenge.

easy

Constrained Language Mode Bypass

Escape PowerShell Constrained Language Mode and see the traces each bypass leaves behind.

medium

Kansa Live Triage

Learn Kansa, a PowerShell framework for sweeping many hosts during incident response.

medium

KAPE Data Triage

Learn KAPE, a targeted Windows artifact collection tool for incident response.

medium

Wi-Fi Fundamentals and Reconnaissance

Learn how Wi-Fi works and use airodump-ng to map networks and reveal hidden SSIDs.

easy

The Clean Exit

THM Security Services has been engaged for a Digital Forensics activity for GlobalTech Manufacturing.

medium

Key Artifacts for DFIR

Explore what artifacts to collect from a compromised host during DFIR.

medium

Accessing a Compromised Network

Learn the ways to access a compromised network for DFIR needs.

medium

Phantom Fob

The fob locks but won’t unlock. Codes change every second, forge the signal; don’t replay it.

medium

The Crown Jewel

Triage a critical alert using Wireshark and Splunk to trace the network intrusion attempt.

easy

Zero Tolerance

A full attack chain investigation CTF challenge using Splunk logs and KAPE artifacts.

medium

Portal Drop

Investigate a suspected breach on a CRM portal using logs and EDR data.

easy

Just a VPN Login

Gather threat intel to determine the risks and assist incident response.

easy

Phishing Books

Uncover and investigate a phishing campaign targeting the education sector.

easy

Promotion Night

Earn the quickest promotion ever, or make it your last day at ProbablyFine.

medium

Chameleon Escape

Trace a recent MECCHA CHAMELEON vulnerability from a malicious custom map to remote code execution.

easy

Advanced Container Escape Techniques

Pivot across a hardened Docker network via shared volumes, raw disk mounts, and a kernel module.

medium

Agent Hardening

Learn how to identify security weaknesses in AI agents and harden them against attack.

easy

Detecting Persistent DLL Attacks

Hunt registered DLL persistence in Windows registry extension points across an offline triage collection

hard