Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
UEBA easy 2
Easy CTF 2 - Service Account Gone Wrong You are reviewing UEBA alerts for your organization's Active Directory environment. A service account called svc_backup is flagged. Its expected behavior: Runs…
UEBA easy 1
Easy CTF 1 - Spot the Anomalous Login You are a SOC analyst reviewing login activity for a company employee named maria.ionescu . Her normal behavior baseline looks like this: Login hours: 08:00 –…
siem medium
Medium CTF – Multi-Source Investigation Your SIEM ingests logs from endpoint, DNS, and authentication sources. You observe the following timeline: The user reports only opening an email attachment.…
siem hard
Hard CTF – Stealthy Attack Timeline Reconstruction You are investigating a possible compromise using SIEM data from multiple sources. Timeline: The account normally connects only during business hours…
siem easy 2
Easy CTF 2 – Basic Log Correlation You are analyzing web and firewall logs collected into the SIEM. You notice the following sequence: The outbound connection came from the same web server. Question…
siem easy 1
Easy CTF 1 – Suspicious Login Pattern You are reviewing authentication logs inside a SIEM dashboard after an alert about unusual logins. You notice the following events: A few minutes later, a new…
SA medium
Medium CTF – Log Correlation Investigation You are correlating web and system logs after suspicious outbound traffic was detected. Web log excerpt Process log excerpt (2 minutes later) Question What…
SA hard
Hard CTF – Incident Timeline Reconstruction You are asked to build a quick timeline from server artifacts. Authentication log Bash history (deploy user) Network log Question What is the clearest…
SA easy 2
Easy CTF 2 – Suspicious Process Discovery During routine monitoring, you run a process listing and find: You check the system and confirm that nothing in should run as a persistent service. Question…
SA easy 1
Easy CTF 1 – Unusual Login Pattern You are reviewing authentication logs from a Linux web server after a security alert. You notice the following entries: The server normally only allows internal…
PA medium
Medium CTF - AD Attack Path You run BloodHound against the domain and it highlights the following attack path: is a regular support employee. Their workstation was hit by a phishing email earlier…
PA hard
Hard CTF - Cloud IAM Escalation You are reviewing an AWS environment with Prowler after a suspicious API call was logged by CloudTrail: The account is a CI/CD service account used by the build…