Lockdown LabCyberDefenders Lab Scenario TechNova Systems’ SOC has detected suspicious outbound traffic from a public-facing IIS server in its cloud platform—activity suggestive of a web-shell drop and covert conn20 min read·iluvblue.hashnode.devOct 14
DanaBot LabAnalyze network traffic using Wireshark to identify DanaBot initial access, deobfuscate malicious JavaScript, and extract IOCs like IPs, file hashes, and execution processes. Here is a link to the lab4 min read·iluvblue.hashnode.devOct 10
Reference Document -> RMMI got these emails from an insurance company: First one from the agent: From the company itself: The emails addresses were legitimate addresses because I had corresponded with them before. However10 min read·iluvblue.hashnode.devOct 3
Zillow Listing to RMMZillow Listing -> "Virtual Tour" -> Fake Zoom Url Analysis While looking for apartments, someone sent me a link to a "virtual tour" of the apartment. They said it was via zoom. This was not a zoom lin5 min read·iluvblue.hashnode.devSep 24
Emulation FTW!Sample from Samplepedia Goal: Extract the next stage download url # File Information File Type: Microsoft Encrypted Structured Storage Object || CDFV2 Encrypted CDFV2 Encrypted indicates that a Micro9 min read·iluvblue.hashnode.devSep 23
