Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
Startup Registry Injection
Startup Registry Injection The Windows Registry is a database that stores low-level settings for the operating system and for applications. Certain registry keys tell Windows what programs to run…
Service Recovery Hijacking
Service Recovery Hijacking When a Windows service crashes, the OS does not just sit there - it follows a set of recovery instructions you can configure. Those instructions can tell Windows to restart…
Malicious Email Rules
Malicious Email Rules When an attacker gets into someone's email account, the first thing they usually do is not read the emails. They set up rules. Email rules are a built-in feature of almost every…
Dormant Malware
Dormant Malware Dormant malware is malicious code that sits quietly on a system and does nothing - until something wakes it up. That trigger could be a specific date, a user logging in, the system…
TPMI medium
Medium CTF - Backdoor Behavior Your UEBA platform flags an anomaly on a build server. You pull the relevant logs: The CI runner executed a build job that used a third-party Python package called . No…
TPMI hard
Hard CTF - Full Supply Chain Compromise You are a security analyst at a mid-sized fintech company. A threat intelligence feed flags one of your dependencies - - as potentially backdoored. You start…
TPMI easy 2
Easy CTF 2 - Suspicious Update A company's IT team pushes a routine software update to all workstations on a Monday morning. By noon, the SOC receives alerts from multiple machines showing the same…
TPMI easy 1
Easy CTF 1 - Tainted Package A developer pulls in a popular open-source logging library for their Node.js project. They run and the package installs without errors. A week later, the security team…
SRI medium
Medium CTF - Persistence Through Reboot A SOC analyst receives an alert that a host is beaconing out to an unknown IP every time it reboots. The malware was already removed from disk, but the…
SRI hard
Hard CTF - Layered Registry Persistence You are investigating a heavily compromised endpoint. The attacker used a layered persistence strategy - two registry mechanisms working together so that…
SRI easy 2
Easy CTF 2 - Registry Artifact Hunt During an incident investigation, you run the following command on a compromised machine: The output comes back as: You check the other two entries and they are…
SRI easy 1
Easy CTF 1 - Suspicious Run Key You are doing a routine check on a Windows workstation after a user reported their antivirus was disabled. You open the registry and browse to: You find the following…