Ddark3v3iniluvblue.hashnode.dev·4d ago · 20 min readLockdown LabCyberDefenders Lab Scenario TechNova Systems’ SOC has detected suspicious outbound traffic from a public-facing IIS server in its cloud platform—activity suggestive of a web-shell drop and covert conn00
Ddark3v3iniluvblue.hashnode.dev·Oct 10 · 4 min readDanaBot LabAnalyze network traffic using Wireshark to identify DanaBot initial access, deobfuscate malicious JavaScript, and extract IOCs like IPs, file hashes, and execution processes. Here is a link to the lab00
Ddark3v3iniluvblue.hashnode.dev·Oct 3 · 10 min readReference Document -> RMMI got these emails from an insurance company: First one from the agent: From the company itself: The emails addresses were legitimate addresses because I had corresponded with them before. How00
Ddark3v3iniluvblue.hashnode.dev·Sep 24 · 5 min readZillow Listing to RMMZillow Listing -> "Virtual Tour" -> Fake Zoom Url Analysis I browsed to that page on a linux device, and got the prompt about it requiring a Windows Desktop system to run. The fake zoom url: zoom-meet00
Ddark3v3iniluvblue.hashnode.dev·Sep 23 · 9 min readEmulation FTW!Sample from Samplepedia Goal: Extract the next stage download url # File Information File Type: Microsoft Encrypted Structured Storage Object || CDFV2 Encrypted CDFV2 Encrypted indicates that a Micro00
