Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
evilginx
Evilginx Lab Goal The goal of this lab is to introduce Evilginx , a reverse-proxy phishing framework that has been used in real-world phishing campaigns. In this lab, we will demonstrate how attackers…
beef
Browser Exploitation Framework (BeEF) Ubuntu VM In this lab we will Start the BeEF framework Hook a victim browser using a JavaScript hook Explore what information BeEF collects automatically Execute…
atomic red team
This is a lab from John Strand 's Active Defense and Cyber Deception Course: https://www.antisyphontraining.com/product/active-defense-and-cyber-deception-with-john-strand/ Atomic Red Team And…
Dynamic Link Library Hijacking
Dynamic Link Library(DLL) Hijacking A DLL (Dynamic Link Library) is a file that contains code and data that multiple programs can use at the same time. Think of it like a shared toolbox - instead of…
NUA medium
Medium CTF - Persistence Chain You are a SOC analyst responding to an alert. An EDR product flagged suspicious process activity on a server at 03:12 AM. You pull the process tree and the relevant…
NUA hard
Hard CTF - Full Intrusion Timeline You are conducting a post-incident investigation. An alert fired four days after the initial compromise - meaning you are working backward from limited artifacts.…
NUA easy 2
Easy CTF 2 - Log Hunt You are reviewing Windows Security event logs on a domain controller. The logs were pulled after a threat hunter flagged unusual activity overnight. You find the following log…
NUA easy 1
Easy CTF 1 - Spot the Account You are reviewing the local user list on a Windows workstation after an alert fired on the endpoint. The machine belongs to a regular employee - no admin work is…
MS medium
Medium CTF - Registry and Service Abuse During an incident response, you image a compromised workstation and start combing through its registry. You find the following key: You pull the binary and…
MS hard
Hard CTF - Full Persistence Chain You are responding to an alert on a Windows Server 2019 machine that handles internal file sharing. The SIEM correlated four events across a 20-minute window. Your…
MS easy 2
Easy CTF 2 - Event Log Dig You are reviewing Windows Event Logs on a machine after an alert fired. You find the following entry in the System log: The machine is a standard workstation. No software…
MS easy 1
Easy CTF 1 - Spot the Service A junior analyst is reviewing the services installed on a Windows endpoint that was flagged by the SIEM. They pull the service list and notice this entry among the usual…