Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
WAD medium
Medium CTF - ACL Abuse You are investigating a security incident. A low-privilege user account named was found to have Domain Admin privileges, but was never manually added to the Domain Admins group.…
WAD hard
Hard CTF - Full Domain Takeover Your SOC receives an alert at 01:30 AM. A UEBA rule fired on a service account called . The account normally only runs scheduled backup jobs on one server between 11 PM…
WAD easy 2
Easy CTF 2 - Trust Issues You are reviewing a SIEM alert. The alert was triggered when a user account from Domain A authenticated against a resource in Domain B . The two domains have a trust…
WAD easy 1
Easy CTF 1 - Reading the Map You are a junior analyst reviewing endpoint logs. A workstation on the network ran the following command: Seconds later, the same host ran: No admin tasks were scheduled…
NSC medium
Medium CTF - Modified Service Investigation You are a SOC analyst. An EDR alert fired on a workstation for "suspicious service modification." You pull the relevant logs and find the following sequence…
NSC hard
Hard CTF - Full Persistence Chain You are performing incident response on a compromised server. You have collected the following artifacts: Artifact 1 - PowerShell History Artifact 2 - Contents of…
NSC easy 2
Easy CTF 2 - Event Log Digging You are reviewing the Windows System Event Log on a machine that was flagged by your SIEM. You find the following entry: The machine belongs to a standard employee with…
NSC easy 1
Easy CTF 1 - Spot the Rogue Service You are doing a routine review of services on a Windows workstation after an alert fired. You run and get the following output (shortened): Question Which service…
LPE medium
Medium CTF – Service Abuse On a Windows system, you enumerate services using an automated tool. One service stands out: Runs as SYSTEM Binary path: The directory is writable by standard users Question…
LPE hard
Hard CTF – Chained Escalation You have a low-privileged shell on a Linux server. Enumeration reveals: A writable script executed by a root cron job The script calls without using an absolute path Your…
LPE easy 2
Easy CTF 2 – Misconfigured Sudo You gain access to a server as a regular user Running the following command: You see: Question Why does this configuration allow privilege escalation? Flags (Choose…
LPE easy 1
Easy CTF 1 – Weak File Permissions You have low-privileged shell access on a Linux server as user While enumerating the system, you run: Output: You are able to edit the file Question Why is this a…