Search

Phantom Fob

The fob locks but won’t unlock. Codes change every second, forge the signal; don’t replay it.

medium

The Crown Jewel

Triage a critical alert using Wireshark and Splunk to trace the network intrusion attempt.

easy

Zero Tolerance

A full attack chain investigation CTF challenge using Splunk logs and KAPE artifacts.

medium

Portal Drop

Investigate a suspected breach on a CRM portal using logs and EDR data.

easy

Just a VPN Login

Gather threat intel to determine the risks and assist incident response.

easy

Phishing Books

Uncover and investigate a phishing campaign targeting the education sector.

easy

Promotion Night

Earn the quickest promotion ever, or make it your last day at ProbablyFine.

medium

Chameleon Escape

Trace a recent MECCHA CHAMELEON vulnerability from a malicious custom map to remote code execution.

easy

Advanced Container Escape Techniques

Pivot across a hardened Docker network via shared volumes, raw disk mounts, and a kernel module.

medium

Agent Hardening

Learn how to identify security weaknesses in AI agents and harden them against attack.

easy

Detecting Persistent DLL Attacks

Hunt registered DLL persistence in Windows registry extension points across an offline triage collection

hard

Introduction to Windows IR

Begin your journey into incident response for Windows and Active Directory.

easy

Silver, Golden, and Diamond Tickets Detection

Detect and investigate forged Kerberos tickets from the artifacts they leave behind.

hard

Detecting LSASS Memory Dumping

Learn how to identify and defend against LSASS memory dumping with logs and artifacts.

medium

RDP Lateral Movement Analysis

Trace RDP lateral movement through Windows event logs and on-host triage artifacts.

medium

Trusted By Default

Investigate suspected abuse of a trusted service account at Aurora Retail Group.

medium

Agent Evaluation

Learn how to evaluate and improve the reliability of AI security agents.

easy

Frankesqwen

Can you find the flag nested in Frankesqwen?

hard

Agent Building

Build a Security Investigation Agent with tools, context, memory, and evidence-based decisions.

medium

The Vantara Leak

THM Security Services has been engaged for a Digital Forensics activity for Vantara Financial Group.

medium

SSH Attacks

Learn how attackers abuse SSH agent forwarding, certificate trust, and shell restrictions.

medium

Agent Foundations

Learn the foundations of building Python-based AI agents.

easy

Grand Larceny Auto II

The sequel that shipped, with a vault the developers made that you can't just decompile your way into.

medium