Cyber Security Free Resource

[cyber-security-free-resource]

Decoding Encoded String with Cyberchef

In this tutorial, I show how to decode an obfuscated PowerShell string using CyberChef and reveal the hidden script inside. If you’re into blue team, DFIR, or cybersecurity labs — this one’s for you. Here is the encoded string as well if you want to practice yourself.…

View On WordPress

[cyber-security-free-resource]

CyberDefenders Patrick Lab Walkthrough (iOS Forensics)

Hello again to another blue team CTF walkthrough now for more mobile analysis or iOS forensics! This is Patrick lab in CyberDefenders.org. Here is the link for my youtube tutorial. If you find this helpful please like share and subscribe too as this will help me too in continuing to do this kind of stuff. Thanks 🙂 Challenge Link: https://cyberdefenders.org/blueteam-ctf-challenges/patrick/ Also…

View On WordPress

[cyber-security-free-resource]

CyberDefenders PsExec Hunt Lab Walkthrough (PCAP Analysis)

Hello again to another blue team CTF walkthrough now for more PCAP analysis! This is PsExec Hunt in CyberDefenders.org.  Here is the link for my youtube tutorial. If you find this helpful please like share and subscribe too as this will help me too in continuing to do this kind of stuff. Thanks 🙂 Challenge Link: https://cyberdefenders.org/blueteam-ctf-challenges/psexec-hunt/  Also last but not…

View On WordPress

[cyber-security-free-resource]

Cyberdefenders.org Amadey Walkthrough

Hello again to another blue team CTF walkthrough now for more memory analysis! This is Amadey Challenge in CyberDefenders.org. Challenge Link: https://cyberdefenders.org/blueteam-ctf-challenges/amadey/ Also last but not the least, you have seen how awesome their CTF challenges and their content are. To really get the best out of it I would recommend taking their CCD (Certified CyberDefender)…

View On WordPress

[cyber-security-free-resource]

Network Analysis – Malware Compromise BTLO Walktrhu

Hello again for another Network Forensics episode this time featuring Network Analysis – Malware Compromise Challenge from BlueTeamLabs.Online This is another fantastic training platform. I figured would be faster if I shared my video walkthru than creating another writeup from the video. 🙂 #networkforensics #ctf #blueteam #dfir #wireshark

View On WordPress

[cyber-security-free-resource]

HackTheBox Reminiscent Walkthrough

Hello again to another blue team CTF walkthrough now from HackTheBox title Reminiscent – a memory analysis challenge. Woohoo more Volatility stuff! Challenge Link: https://app.hackthebox.com/challenges/reminiscent CHALLENGE DESCRIPTION Suspicious traffic was detected from a recruiter's virtual PC. A memory dump of the offending VM was captured before it was removed from the network for…

View On WordPress

[cyber-security-free-resource]

HackTheBox Diagnostic Walkthrough

Hello again to another blue team CTF walkthrough now from HackTheBox title Diagnostic – an ole document analysis challenge Challenge Link: https://app.hackthebox.com/challenges/reminiscent CHALLENGE DESCRIPTION Our SOC has identified numerous phishing emails coming in claiming to have a document about an upcoming round of layoffs in the company. The emails all contain a link to…

View On WordPress

[cyber-security-free-resource]

Cyberdefenders.org FalconEye Blue Team Challenge Walkthrough  

Hello again to another blue team CTF walkthrough now for more Splunking! This is FalconEye Blue Team Challenge in CyberDefenders.org. Some of the interesting things in this challenge are as follow but not limited to; -Dcsync attack -Pass-The-hash -Lateral Movement techniques -Mimikatz And more J Challenge Link:…

View On WordPress

[cyber-security-free-resource]

Cyberdefenders.org RedLine Blue Team Challenge Walkthrough

Hello again to another blue team CTF walkthrough now for more memory forensics! This is Redline Blue Team Challenge in CyberDefenders.org. Challenge Details: Scenario: As a member of the Security Blue team, your assignment is to analyze a memory dump using Redline and Volatility tools. Your goal is to trace the steps taken by the attacker on the compromised machine and determine how they…

View On WordPress

[cyber-security-free-resource]

LetsDefend.io SOC202 - FakeGPT Malicious Chrome Extension Walkthru

LetsDefend.io SOC202 – FakeGPT Malicious Chrome Extension Walkthru Hello and today we will solve the alert SOC202 – FakeGPT Malicious Chrome Extension.  We can trust popular apps like ChatGPT but we must verify. Alert Details You need to first Take Ownership of the incident then create a case to begin investigation. Investigation Click Start Playbook It will give a short explanation of the…

View On WordPress

[cyber-security-free-resource]

Letsdefend.io Disclose the Agent Walkthrough

Hello again to another blue team CTF walkthrough now for more pcap network forensics! This is Letsdefend.io Disclose the Agent challenge. Challenge Details: We reached the data of an agent leaking information. You have to disclose the agent. Log file: https://api.letsdefend.io/download/downloadfile/smtpchallenge.zip Pass: 321 Note: pcap file found public resources.  Question and…

View On WordPress

[cyber-security-free-resource]

Cyberdefenders.org Hunter  Walkthrough

Hello again to another blue team CTF walkthrough now for more disk forensics! This is Hunter Challenge in CyberDefenders.org. Some of the interesting things in this challenge are as follow but not limited to; Investigating full disk image using FTK imager Investigating registries Investigating shellbag Investigating jump lists Fornesic tools to check out these artifacts And more…

View On WordPress

[cyber-security-free-resource]

Cyberdefenders.org Malware Traffic Analysis Part 6 CTF Walkthrough

Cyberdefenders.org Malware Traffic Analysis Part 6 CTF Walkthrough

Hello again to another blue team CTF walkthrough for more network forensics and malware analysis. Shall we start? This is now the 6th instalment of Malware Traffic Analysis Challenge in CyberDefenders.org. Credits to Brad Duncan for these awesome challenges! Some of the interesting things in this challenge are as follow but not limited to; Finding and exporting files from pcap file using…

View On WordPress

[cyber-security-free-resource]

Cyberdefenders.org Malware Traffic Analysis Part 5 CTF Walkthrough

Cyberdefenders.org Malware Traffic Analysis Part 5 CTF Walkthrough

Hello again to another blue team CTF walkthrough for more network forensics and malware analysis. Shall we start? This is the 5th instalment of Malware Traffic Analysis Challenge in CyberDefenders.org Some of the interesting things in this challenge are as follow but not limited to; Phishing Email Analysis Malicious Attachments Finding and exporting files from pcap file using Network…

View On WordPress

[cyber-security-free-resource]

Cyberdefenders.org Malware Traffic Analysis Part 4 CTF Walkthrough

Cyberdefenders.org Malware Traffic Analysis Part 4 CTF Walkthrough

Hello again to another blue team CTF walkthrough for more network forensics and malware analysis. Shall we start? This is the 4th instalment of Malware Traffic Analysis Challenge in CyberDefenders.org Some of the interesting things in this challenge are as follow but not limited to; ·       ·        Finding and exporting files from pcap file using Network Miner ·       ·        Navigating and…

View On WordPress

[cyber-security-free-resource]

LetsDefend.io SOC139 - Meterpreter or Empire Activity Walkthrough (Malware)

LetsDefend.io SOC139 – Meterpreter or Empire Activity Walkthrough (Malware)

Hello and today we will solve the alert SOC139 – Meterpreter or Empire Activity. It is good reminder to be always familiar with attacker tools as well and how to detect those. Alert Details You need to first Take Ownership of the incident then create a case to begin investigation. Investigation Click Start Playbook Then the playbook steps will kick-start remember the PICERL Incident response…

View On WordPress

[cyber-security-free-resource]

LetsDefend.io SOC175 — PowerShell Found in Requested URL — Possible CVE-2022–41082 Exploitation

LetsDefend.io SOC175 — PowerShell Found in Requested URL — Possible CVE-2022–41082 Exploitation

Hello and today we will solve the alert SOC175 — PowerShell Found in Requested URL — Possible CVE-2022–41082 Exploitation. This exploit targets Exchange Servers and was a zero-day RCE vulnerability that is just recently discovered. In fact there were still no available patches from MS as of this writing (Oct 13, 2022). Alert Details You need to first Take Ownership of the incident then create a…

View On WordPress