Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
SLEHackingLab
Lab 6 - Exploiting an Unauthenticated SLE Management Plane Context This lab demonstrates a realistic vulnerability class : unauthenticated exposure of a management/control plane in a protocol-heavy…
Intercept Lab
Lab 1 - The Intercept Scenario : Your team is hired to test the downlink resilience of a startup's CubeSat, ODYSSEY-1 They claim the link is secure. You're given two historical baseband captures from…
Defending Odyssey Lab - Part 1
Blue Lab 1 - Defending ODYSSEY-1: API & DoS Protection Scenario: You are blue team for ODYSSEY-1. Red team has: Replayed stale telemetry into the groundstation Flooded and on your groundstation…
coursenavigation
Course Navigation Welcome Start Here! Getting Support Log Analysis Basics Windows Event Logs Sysmon Logs Authentication Logs Tools to Learn Log Analysis Lab Security Tools & Foundational Platforms…
zeek
Zeek — SOC Analyst Playbook (Cheat-sheet + Expanded) Zeek (formerly Bro) is an event-driven network security engine that passively monitors traffic, parses protocols, extracts metadata and generates…
wireshark
Wireshark Wireshark is a powerful open-source network protocol analyzer used for capturing and analyzing packets in real time. It is an essential tool for any SOC Analyst to inspect suspicious network…
WinEventViewer
Windows Event Viewer Windows VM The file for the lab is under: Windows Event Viewer is a built-in administrative tool that allows users to view and analyze logs of system, security, and application…
tcpdump
tcpdump tcpdump is a powerful command-line packet analyzer that allows you to capture and inspect live traffic on a network. It is commonly used for quick triage, scripting, and environments where a…
suricata
Suricata Suricata is a powerful open-source Network Security Monitoring (NSM), Intrusion Detection System (IDS), and Intrusion Prevention System (IPS) engine. Developed by the Open Information…
snort
Snort Snort is an open-source Network Intrusion Detection System (NIDS) and Intrusion Prevention System (IPS) developed by Cisco. It inspects network traffic in real-time and uses a powerful…
PEStudio
PEstudio for Linux Overview PEstudio is a static analysis tool used to examine Windows executables for potential indicators of compromise without running the file. While PEstudio is natively a Windows…
IDA Free
Overview IDA Pro (Interactive DisAssembler) is a powerful disassembler and debugger used in malware analysis, reverse engineering, and vulnerability research It converts binary executables into…