Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
AF medium
Medium CTF - Persistence via Sticky Keys A workstation was flagged by your SIEM after business hours activity. You pull the event logs and find the following sequence: No USB devices were logged at…
AF hard
Hard CTF – Full Physical Attack Simulation You are a SOC analyst investigating a reported incident at a branch office. An employee noticed the screen on an unattended reception desk PC acting…
AF easy 2
Easy CTF 2 - USB Drop Investigation A USB device was found in a company parking lot and, unfortunately, someone plugged it in. The endpoint security tool logged the following activity seconds after it…
AF easy 1
Easy CTF 1 - Spot the Swap You are reviewing a Windows workstation after a suspicious USB device was found plugged into it. A junior analyst ran a quick file integrity check on the system32 folder and…
Application Shimming
Application Shimming Application shimming is a Windows technique that was originally created for compatibility. It allows software to run even if it was built for older versions of the operating…
Accesibility Features
Accesibility Features Operating systems ship with built-in accessibility tools meant to help users with disabilities. Things like Sticky Keys, the On-Screen Keyboard, and Magnifier are there for good…
Weaponizing Active Directory
Weaponizing Active Directory Active Directory (AD) is Microsoft's directory service. It's what most corporate networks use to manage users, computers, permissions, and policies in one place. If you've…
New Service Creation Modification
New Service Creation / Modification Services are background processes that run on a system - usually starting automatically when the machine boots. They handle things like networking, logging,…
Local Privilege Escalation
Local Privilege Escalation (LPE) Local Privilege Escalation happens after an attacker already has access to a system, but only as a low-privileged user The goal is simple: turn limited access into…
sharpup
SharpUp Windows VM In this lab we will Create two realistic privilege‑escalation misconfigurations Run SharpUp to audit the system Save the output to a file Locate the misconfigurations in the SharpUp…
seatbelt
Seatbelt Windows VM In this lab we will Create interesting system artifact Check logon events in the past 30 days Run specific Seatbelt enumeration groups Analyze the results Seatbelt Seatbelt is a…
rubeus
Rubeus Ubuntu VM Finished? Back to Card's Main Page