Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
CRED medium
Medium CTF - Automation Detection You are analyzing authentication logs from a SaaS platform. Observations: The security team suspects attackers are distributing traffic to avoid basic rate limits.…
CRED hard
Hard CTF - Credential Stuffing Investigation You are investigating a suspected account takeover campaign. Data summary: Additional context: MFA was optional and disabled on most affected accounts. The…
CRED easy 2
Easy CTF 2 - Login Pattern Analysis A monitoring dashboard shows a sudden spike in login attempts. Summary: Question Which indicator best suggests this is an automated credential stuffing attack?…
CRED easy 1
Easy CTF 1 - Password Reuse Discovery You are reviewing authentication logs from a web application after users reported account lockouts. You notice the following events: All login attempts came from…
BYOED medium
Medium CTF - Tracking a Remote Access Trojan A SOC analyst flags a BYOD laptop after detecting suspicious outbound traffic. You extract the following process information: The user says they did not…
BYOED hard
Hard CTF - BYOD Pivot Into Internal Network An infected personal laptop connects to the corporate VPN. Timeline: Device authenticates successfully. Within 5 minutes, authentication attempts appear…
BYOED easy 2
Easy CTF 2 - Basic Firewall Log Review You are reviewing firewall logs after a security analyst reports unusual activity from a personal device. You notice the following sequence: The user associated…
BYOED easy 1
Easy CTF 1 - Suspicious BYOD Connection A firewall alert shows a personal laptop connecting to the company VPN for the first time. Minutes later, the device starts making connections to an external IP…
Credential Stuffing
Credential Stuffing Credential stuffing is an attack where someone takes stolen username and password pairs (usually leaked in data breaches) and tries them across many websites and services. The…
Compromised Web Server
Compromised Web Server When an attacker gains unauthorized access to a web server, it is deemed compromised . This typically occurs as a result of a vulnerability in the server software, the website,…
Bring Your Own Exploited Device
Bring Your Own (Exploited) Device A compromised device is a personal laptop, phone, or tablet that an attacker has already infected before it connects to a company network. In organizations that allow…
UEBA Analytics
User And Entity Behavious(UEBA) Analytics Most security tools work by matching known bad things - a signature, a rule, a hash. UEBA works differently. It watches how people and systems normally…