---
title: "dark3v3 (@dark3v3) | Hashnode"
description: "Blue Team-er :-). Read the latest articles by dark3v3 on Hashnode."
url: "https://hashnode.com/@dark3v3"
---

@dark3v3

# dark3v3

@dark3v3 · Joined September 2025

Blue Team-er :-)

### [Lockdown Lab](https://iluvblue.hashnode.dev/lockdown-lab?utm_source=hashnode&utm_medium=feed)

CyberDefenders Lab Scenario TechNova Systems’ SOC has detected suspicious outbound traffic from a public-facing IIS server in its cloud platform—activity suggestive of a web-shell drop and covert conn

20 min read · [iluvblue.hashnode.dev](https://iluvblue.hashnode.dev/lockdown-lab?utm_source=hashnode&utm_medium=feed)

[Oct 14](https://hashnode.com/posts/lockdown-lab/6aceed563c770f29af16ee14)

### [DanaBot Lab](https://iluvblue.hashnode.dev/danabot-lab?utm_source=hashnode&utm_medium=feed)

Analyze network traffic using Wireshark to identify DanaBot initial access, deobfuscate malicious JavaScript, and extract IOCs like IPs, file hashes, and execution processes. Here is a link to the lab

4 min read · [iluvblue.hashnode.dev](https://iluvblue.hashnode.dev/danabot-lab?utm_source=hashnode&utm_medium=feed)

[Oct 10](https://hashnode.com/posts/danabot-lab/6aca6a70c78f6ed071ba8a75)

### [Reference Document -> RMM](https://iluvblue.hashnode.dev/reference-document-rmm?utm_source=hashnode&utm_medium=feed)

I got these emails from an insurance company: First one from the agent: From the company itself: The emails addresses were legitimate addresses because I had corresponded with them before. However

10 min read · [iluvblue.hashnode.dev](https://iluvblue.hashnode.dev/reference-document-rmm?utm_source=hashnode&utm_medium=feed)

[Oct 3](https://hashnode.com/posts/reference-document-rmm/6ac118fe3064aeac90376f38)

### [Zillow Listing to RMM](https://iluvblue.hashnode.dev/zillow-listing-to-rmm?utm_source=hashnode&utm_medium=feed)

Zillow Listing -> "Virtual Tour" -> Fake Zoom Url Analysis While looking for apartments, someone sent me a link to a "virtual tour" of the apartment. They said it was via zoom. This was not a zoom lin

5 min read · [iluvblue.hashnode.dev](https://iluvblue.hashnode.dev/zillow-listing-to-rmm?utm_source=hashnode&utm_medium=feed)

[Sep 24](https://hashnode.com/posts/zillow-listing-to-rmm/6ab4b933a89a815b153b09df)

### [Emulation FTW!](https://iluvblue.hashnode.dev/emulation-ftw?utm_source=hashnode&utm_medium=feed)

Sample from Samplepedia Goal: Extract the next stage download url # File Information File Type: Microsoft Encrypted Structured Storage Object || CDFV2 Encrypted CDFV2 Encrypted indicates that a Micro

9 min read · [iluvblue.hashnode.dev](https://iluvblue.hashnode.dev/emulation-ftw?utm_source=hashnode&utm_medium=feed)

[Sep 23](https://hashnode.com/posts/emulation-ftw/6ab367e5fde8d738c14a6528)