Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
HTTPS As Exfil
HTTPS As Exfil Once an attacker is inside a system, they need to get the data out. The obvious problem: the network is being watched. Firewalls block weird ports. Security tools flag unusual traffic.…
Domain Name System As C2
Domain Name System(DNS) As C2 Every device on the internet needs DNS to function. It's the protocol that translates domain names like into IP addresses your computer can actually connect to. Because…
Domain Fronting As C2
Domain Fronting as C2 Once an attacker has a foothold inside a network, they need a way to communicate with their tools remotely. That communication channel is called Command and Control , or C2. The…
http exfil medium
Medium CTF – Hidden Data in Traffic You are analyzing network captures from a web server that was recently compromised. Most traffic looks normal, but you notice a series of requests like this: The…
http exfil hard
Hard CTF – Full Exfiltration Investigation During an incident review, you observe the following: A web server was compromised three days ago. Outbound HTTPS traffic increased slowly over time.…
http exfil easy 2
Easy CTF 2 – Basic Log Investigation You are reviewing web server access logs after suspicious activity was reported. You find the following request: The same host sends similar requests every minute,…
http exfil easy 1
Easy CTF 1 – Odd Outbound Traffic You are reviewing outbound proxy logs from a compromised web server. You notice this pattern repeated every few minutes: The server normally only serves website…
HE medium
Medium CTF - C2 Traffic Investigation A SIEM alert fired on a developer workstation. You pull the relevant logs and find the following sequence of events: A quick WHOIS on shows the domain was…
HE hard
Hard CTF - Full Exfil Hunt You are a SOC analyst. An alert fired overnight and you are reconstructing what happened using logs from three different sources. Endpoint Log (from the affected machine)…
HE easy 2
Easy CTF 2 - Log Pattern Analysis You are going through firewall logs after an endpoint protection alert fired on a machine in the accounting department. You notice the following entries over 30…
HE easy 1
Easy CTF 1 - Spot the Beacon A security analyst is reviewing outbound HTTPS traffic from a workstation that was flagged by the firewall. The logs show the following connections over a 2-hour window:…
DNS medium
Medium CTF - C2 Beacon Identification During a threat hunt, your SIEM flags a host for unusual DNS behavior. You pull the following log excerpt: The subdomains in the A queries decode from Base64 to:…