Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
Server Analysis
Server Analysis A server is considered compromised when someone gains access or control without authorization. This doesn’t always mean the attacker fully owns the machine - sometimes they only have a…
Security Informations And Event Management Log Analysis
Security Informations And Event Management(SIEM) Log Analysis Security Information and Event Management ( SIEM ) is the process of collecting and analyzing logs from many systems in one place so…
Permissions Audit
Permissions Audit Every system has users, and every user has permissions. A permissions audit is how defenders figure out who can access what - and whether that access makes any sense. The goal is…
Network Threat Hunting
Network Threat Hunting Network threat hunting is the practice of actively searching network traffic for signs of malicious behavior instead of waiting for alerts to fire. It focuses on finding…
Memory Analysis
Memory Analysis When a system gets compromised, attackers leave traces. Not always on disk - sometimes only in memory. Memory analysis (also called memory forensics) is the process of pulling a…
wazuh
Wazuh Cloud SIEM & XDR Ubuntu & Windows VM The objective of this lab is to deploy Wazuh Agents to a cloud-hosted SIEM environment, configure File Integrity Monitoring (FIM), simulate malicious…
volatilityLab4
Part1 Part2 Part3 Part4 This is the 4th of 4 parts Setup The commands will be in this template: Your turn Try to find the malware using the commands in the Volatility Documentation and then scroll…
volatilityLab3
Part1 Part2 Part3 Part4 This is the 3rd of 4 parts Setup The commands will be in this template: Your turn Try to find the malware using the commands in the Volatility Documentation and then scroll…
volatilityLab2
Part1 Part2 Part3 Part4 This is the 2nd of 4 parts Setup The commands will be in this template: Your turn Try to find the malware using the commands in the Volatility Documentation and then scroll…
volatilityLab1
Part1 Part2 Part3 Part4 This is the 1st of 4 parts Start In this lab you will be given 4 different linux memory dumps located in , they all have malware inside and your task is to find where is the…
velociraptor
Velociraptor In this lab we will be installing and using Velociraptor to look at the various IR artifacts on your computer. Check out their website here: Velociraptor is a free EDR that can help us…
honeybadger
HoneyBadger Website Description Used to identify the physical location of a web user with a combination of geolocation techniques using a browser's share location feature, the visible WiFi networks,…