Investigations
Defensive labs for the blue team. You're handed real forensic evidence — logs, transcripts, email headers, memory — and must reconstruct what happened. Pure SOC-analyst and incident-response work. No exploitation required.
Brute Force at Dawn
At 04:00 UTC our monitoring flagged a spike in failed SSH logins on `web-prod-01`. Review the authentication log excerpt and determine whether the attacker got in — and if so, how.
The Lure
A user reported a suspicious invoice email. Analyze the raw email headers to assess whether it was spoofed and where it really came from.
Ghost in the PowerShell
An endpoint on the finance subnet triggered an EDR alert for a suspicious encoded PowerShell command. Decode the transcript and identify the attacker's intent and infrastructure.
Midnight Breach: Unauthorized RDP Access & Data Exfiltration
At 02:47 UTC on March 15, 2024, your SIEM triggered an alert for suspicious RDP activity on a Windows file server (FS-PROD-02) hosting sensitive customer records. Multiple failed authentication attempts were followed by a successful login from an unusual geographic location. Your task is to analyze the provided artifacts to determine the scope of the breach, identify the attacker's actions, and assess what data may have been compromised.