/var/log/operations

MISSIONARCHIVE

Tactical reports categorized by operation type. Select a sector to filter.

SYSTEM UPDATE

Sedang Proses Migrasi Writeup

Arsip writeup sedang dipindahkan ke sistem baru. Semua konten akan segera tersedia.

MIGRATING

78 operations found

REDHacktrace Ranges2026-10-315 min read

Zeus

Like in mythology, Zeus had many subordinates who worked for him.

#Hacktrace Ranges#Offensive#Red Team#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Volatify

Winazel found suspicious activity on one of the network servers he monitors. Suspecting a security threat, he decided to perform a deep analysis using Volatility3. Help Winazel analyze the memory dump!

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Vigil

Rizqi received an email that included proof of payment from an unknown organization. After considering it, Rizqi realized that he actually hadn't made any recent purchases or payments. With suspicion, Rizqi decided to seek help from his colleague who is an expert in IT to further examine the authenticity of the email.

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Unlucky

The finance division received an invoice payment in the form of an Excel file containing a payment that needs to be made. The file appears to be legitimate, but there is a suspicious process running when opening the file.

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Undercover

Faishal is an employee who works in the marketing team of the company. He has complained to you several times that his computer seems to not function properly, often being slow and experiencing system failures. Although most of these issues may seem trivial, you have decided to further investigate the root cause.

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace RangesFIRST BLOOD2026-10-315 min read

Uncut

A Manufacturing Plant received document files such as Microsoft Office documents. These files were found on a vendor-specific laptop used by vendors previously working for the plant. The IT Security Team identified and analyzed the files to ensure whether they were malicious and posed a threat to their servers.

#Hacktrace Ranges#Defensive#DFIR#Easy+2

Read Writeup

REDHacktrace Ranges2026-10-315 min read

Terra

Secured server to create world maps !

#Hacktrace Ranges#Offensive#Red Team#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Temptandum

In my organization, there has been a security incident. Below is the network data that indicates a potential security incident. You are an analyst—can you help me determine what actually happened?.

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Sustain

John, an employee at XYZ company, was working on his computer when he suddenly realized that changes had been made to his system without permission. Although he is unsure what happened, John is very concerned about the security of his data and the company's sensitive information. Help John analyze his computer.

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace RangesFIRST BLOOD2026-10-315 min read

superwhale

Putra was working from a coffee shop on a normal workday, casually deploying a small personal project he had been building for fun. He believed everything was running only on his own laptop and didn’t give much thought to the environment around him. While focused on coding and enjoying his coffee, he overlooked a few security assumptions common during development. Later, unexpected activity suggested his project had been seen by someone else on the same network.

#Hacktrace Ranges#Defensive#DFIR#Moderate+2

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Subvert

You're Tier-2, and this honeypot? Your ghost trap—left idle to catch something big. When the breach hits, old noise resurfaces: they were here first. Scanning. Payloads. Probing the wires. It's no accident. Dig through the static and pull the truth from the shadows.

#Hacktrace Ranges#Defensive#DFIR#Moderate+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

StegOzint!

Indonesian police arrested a group of hitmen who called themselves the Seroja gang, the police raided the gang's office and confiscated all the assets located there. The police found a suspicious folder on a laptop in the office, but the police had difficulty opening it because the folder was locked. You as the cyber team are asked to find out what information is inside, can you open it? *NOTE: jangan lupa mainin bit selection nya ya

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Shortway

Our network security team has detected suspicious activity on one of our internal systems, indicating a potential malware infection. We need assistance to investigate this activity further, assess its potential impact on other systems, and ensure there is no further risk to our IT infrastructure.

#Hacktrace Ranges#Defensive#DFIR#Moderate+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Reversity

Don, a malware analyst, extracts an unknown binary from an infected endpoint. Initial static analysis reveals it as a highly obfuscated malware with possible keylogging and backdoor functionality. The binary appears to be packed, making it difficult to analyze. Help Don to analyze the sample, unpack it, and identify its true capabilities!

#Hacktrace Ranges#Defensive#DFIR#Moderate+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Remembrance

An incident occurred on one of your organization's employee PCs. The DFIR team has successfully obtained digital evidence in the form of a copy of the OS memory (RAM). Help the DFIR team analyze this digital evidence.

#Hacktrace Ranges#Defensive#DFIR#Moderate+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

PhishHunt

An employee from the Finance Division named Sarah is the target in this scenario. Sarah is an experienced accountant who often receives emails from various vendors, customers, and colleagues regarding the company's financial transactions. These emails are very convincing and appear to be official emails from the bank. Please help Sarah ensure whether the email originates from an official bank source or not.

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

PcapProbe

The Security Operations Center (SOC) team of a company has detected an attack on a server that is believed to have been compromised. They only have evidence in the form of a PCAP (Packet Capture) file containing suspicious traffic from unknown IP addresses. The SOC team now needs to analyze the PCAP file to identify the attack and its patterns. Please assist the SOC team in analyzing the PCAP file!

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

NowYouSeeMe

A month ago, Vina lost her cellphone at RS Maju Mundur. Suddenly, today Vina received an email from the software company 4ctiv3X to add additional software installation to secure the 4ctiveX software. What should Vina do to validate that it is safe?

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Misconf

A highly critical cybersecurity incident has occurred, significantly impacting the company's systems and sensitive data. This incident was caused by human error, specifically an unintentional action by a member of the [Related Division] team. This action created a security vulnerability, which was exploited by malicious actors, resulting in unauthorized access to the company's internal systems.

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Mischievous

Inside malware.zip (password: infected), there is a known and detected malware named rootkit.ex1 (DO NOT RUN THIS FILE!).

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Loki

The Tier-1 analyst provides you with a file in ISO format discovered during incident response. As a malware analyst, you are tasked with analyzing and extracting IoCs from the malware.

#Hacktrace Ranges#Defensive#DFIR#Hard+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

LogBreaker

Karina, a web programmer, has completed a web server development project for her company but has overlooked prioritizing security. Unaware of the potential risks, her server becomes a target for attackers who successfully damage critical data and access confidential company information. The IT Security team suspects that the attackers exploited vulnerabilities that were not secured by Karina. They request assistance in investigating the attack on the web server.

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

REDHacktrace Ranges2026-10-315 min read

LaBoum

LaBoum is a web application that uses the film La Boum as its background story. Players can explore rare attack surfaces that can be exploited to target both the application and the server. Overall, it is a fun and engaging machine.

#Hacktrace Ranges#Offensive#Red Team#Moderate+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

KeyboardWarrior

Mr. Yanto reported to the IT team that he accidentally opened a suspicious document. He reported that since opening the document, many login attempts and 2MFA requests have appeared on his various accounts. As SOC, you successfully retrieved the malicious document from Mr. Yanto's computer. Please analyze the document.

#Hacktrace Ranges#Defensive#DFIR#Moderate+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Joedway

CONGRATULATIONS!!! You have just been hired as a Security Analyst at JDW Corp. However, there is no time for a celebration. On your very first day, you discover that the company's internal infrastructure has been compromised. Last week, a senior developer at JDW Corp was tasked with implementing a Single Sign-On (SSO) integration for a critical internal project. To speed up the process, the developer searched for a suitable library online and found an NPM package hosted on GitHub that appeared to be legitimate and perfect for the task. Without performing a thorough security audit, the developer cloned the repository and installed the package into the JDW Internal Project environment. Shortly after the installation, unusual network activity was detected, and sensitive data began leaking to an unknown external server.

#Hacktrace Ranges#Defensive#DFIR#Moderate+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

IntrudeX

A company experienced a damaging cyber attack, with sensitive data stolen and operational systems disrupted. This incident has caused panic throughout the company, underscoring the urgent need for cybersecurity improvements. The incident must be promptly analyzed to identify its root causes and take appropriate preventive actions.

#Hacktrace Ranges#Defensive#DFIR#Moderate+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Inscept

You are a cybersecurity analyst working for a large company that has recently experienced increased cyber-attack activity. Your task is identifying, analyzing, and responding to attacks targeting the company's systems.

#Hacktrace Ranges#Defensive#DFIR#Moderate+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Immortal

An employee has lost access to their cryptoasset wallet and has asked you to analyze and restore access. Information regarding the cryptoasset is stored on a USB flash drive. You perform an imaging of the flash drive and analyze it. Can you restore access?

#Hacktrace Ranges#Defensive#DFIR#Hard+1

Read Writeup

BLUEHacktrace RangesFIRST BLOOD2026-10-315 min read

Idol

An HR officer in our company is obsessed with a famous singer from the Hidden Leaf Village. One morning, she received a mysterious voice message from an unknown number claiming to be her beloved idol. Thinking it was just a harmless voice note, she downloaded the file. Shortly after, strange activity began appearing on her device: several financial apps showed unauthorized login attempts. As the SOC analyst, you managed to recover the compromised device and secure the affected accounts. During the investigation, you discovered the so-called voice note was no ordinary audio file—it was laced with malicious code.

#Hacktrace Ranges#Defensive#DFIR#Easy+2

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Huninn

One day, one of the employees in our office found a USB drive on their desk. It was unclear where the USB came from. When they checked it, they found a mysterious application that seemed unrelated to our work. Without hesitation, they decided to report it to the IT Team so that the application could be analyzed.

#Hacktrace Ranges#Defensive#DFIR#Moderate+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Evfronet

Anomaly detected in the network leading to the server, can you find it?

#Hacktrace Ranges#Defensive#DFIR#Moderate+1

Read Writeup

REDHacktrace Ranges2026-10-315 min read

DNS-2

The book containing the list of names usually has a copy. If lost, the copy can still be seen. Of course the content is the same. By mastering this copy, one can open access to new spaces.

#Hacktrace Ranges#Offensive#Red Team#Easy+1

Read Writeup

REDHacktrace Ranges2026-10-315 min read

DNS-1

In an organization, there is usually one book that lists names. In the digital world, the list of occupants is officially registered here. Can you identify who they are?

#Hacktrace Ranges#Offensive#Red Team#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Deviasi

Inside the zip file named what_happened_here.zip, you will find a log file. You need to analyze the log to determine the cause of the attack.

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Deimos

The SOC team has sent a network packet capture capturing suspicious activity on one of the hosts in your organization. You are requested to investigate and analyze the network packet capture so that it can be followed up by the forensic team.

#Hacktrace Ranges#Defensive#DFIR#Hard+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Credsnoop

KGT Company is a large corporation with a complex network infrastructure and a series of servers used by its employees to access business applications and data. At one point, the KGT Company's system experienced an attack. Can you find out how the attacker managed to gain entry into the system?

#Hacktrace Ranges#Defensive#DFIR#Moderate+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

ClownBot

On the recent Eid al-Fitr holiday, the Customer Support team received a OneNote file from an unknown person. Subsequently, they reported it to the SOC team for validation process regarding the file. You, as part of the SOC team, decide to analyze the OneNote file. [NOTE: This is genuine malware, so proceed with caution]

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Cilent

Inside the password-protected zip file, you will find an email file (.eml). Analyze the email and its attachment to determine whether it is legitimate or malicious. Identify the technique used to disguise the file and explain the attack method involved.

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

BLUEHacktrace RangesFIRST BLOOD2026-10-315 min read

Charon

The national CSIRT involves you in the investigation of a cyberattack on a government ministry. The CSIRT team has successfully acquired disk and memory evidence from a virtualized system suspected of being infected with malware. As a forensic expert, you are requested to analyze the evidence and identify the malware that has infected the ministry.

#Hacktrace Ranges#Defensive#DFIR#Hard+2

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

BluuShell

Katarina is a SOC analyst. While on duty, she discovered a suspicious PowerShell script within the monitored network system. Upon investigation, she found that the script originated from a Word document file. Help Katarina conduct an analysis of the suspicious Word document file!

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

REDHacktrace Ranges2026-10-315 min read

Ballpoint

The name 'Ballpoint' doesn't really give a hint, and we're not talking about pens either. Anyway, let's just get to the assignment. It's easier than you think.

#Hacktrace Ranges#Offensive#Red Team#Easy+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Argus

You, as a Tier-2 analyst, receive an alert escalated by Tier-1 in a SOC operation. The Tier-1 lead sends you a packet capture (PCAP) file containing suspicious activity from an internal asset of the organization. You are asked to conduct a thorough investigation into the suspicious activity from that asset.

#Hacktrace Ranges#Defensive#DFIR#Moderate+1

Read Writeup

REDHacktrace Ranges2026-10-315 min read

Ares

From eavesdropping on conversations at the Hacktrace cafe, the owner of this machine thinks that security through obscurity will be safer than implementing security on his web server.

#Hacktrace Ranges#Offensive#Red Team#Moderate+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Aegis

A server is suspected of establishing a connection with a C2 server. The incident response team triages by dumping the memory of that server. You are requested to analyze the memory dump results of the server affected by this incident.

#Hacktrace Ranges#Defensive#DFIR#Hard+1

Read Writeup

BLUEHacktrace Ranges2026-10-315 min read

Actry

The DAY company is a large corporation that operates many critical corporate servers storing sensitive data. One of their main servers is the database server containing client information, financial data, and other important information. This server is heavily protected and only accessed by personnel with valid access credentials. As part of the Security Team, are you tasked with checking for any unauthorized access?

#Hacktrace Ranges#Defensive#DFIR#Easy+1

Read Writeup

REDHack The Box2026-10-315 min read

Puppet

You are tasked with performing a red team engagement on Puppet Inc. Puppet is a small active directory scenario in which you start with an already running Sliver C2 beacon on an internal system. Designed to practice operating through a C2 framework in a modern hybrid environment covering Active Directory enumeration, DevOps exploitation, and lateral movement.

#Hack The Box#Pro Lab#Red Team#Active Directory+3

Read Writeup

REDHack The Box2026-10-315 min read

Mythical

You are tasked with performing a red team engagement on Mythical Inc. Mythical is an active directory scenario in which you start with an already running Mythic C2 beacon on an internal system. Designed to practice operating through a modern C2 framework covering ADCS, MSSQL attacks, and lateral movement.

#Hack The Box#Pro Lab#Red Team#Active Directory+4

Read Writeup

BLUEHack The Box2026-10-295 min read

Frosted

FrostLine Analytics, an internal data reporting firm, noticed one of their containerized services making outbound connections it had no business making. Rather than kill the container and lose whatever was sitting in memory, the security team took a checkpoint of it while it was still running and pulled it offline for analysis. Reconstruct the compromise and full attack timeline.

#Hack The Box#Sherlock#DFIR#Container Forensics+2

Read Writeup

BLUEHack The Box2026-10-275 min read

Yggdrasil

An unauthorized outbound connection was detected on one of our Ubuntu machines assigned to the development team, triggering an immediate security alert — the machine was isolated and handed off for triage. Investigate the incident and determine the full attack chain.

#Hack The Box#Sherlock#DFIR#Ubuntu Forensics+2

Read Writeup

BLUEHack The Box2026-10-275 min read

SaSync

You are an Incident Responder awakened at 02:00 AM by your pager. The SOC team has escalated a high-risk incident affecting the ShanoCorp Active Directory environment. Adversaries are suspected to have breached a neglected child domain that had been retained for testing purposes, where insecure configurations were left exposed.

#Hack The Box#Sherlock#DFIR#Active Directory+2

Read Writeup

BLUEHack The Box2026-10-275 min read

Opportunist

Our team was called in to investigate a security incident of an internal web application running on container infrastructure. Attackers exploited opportunistic vulnerabilities to pivot into the application environment. Your task is to reconstruct the attacker activity and timeline.

#Hack The Box#Sherlock#DFIR#Docker Triage+2

Read Writeup

BLUEHack The Box2026-10-265 min read

ShellForSell

A recently deployed internal server is believed to have been compromised. The server serves multiple purposes internally at Alliance Systems; thus, it is critical to understand the extent of the incident. A triage image from the UAC tool has been provided. However, the incident is believed to have occurred at least a day before the incident team was informed, so live artifacts may not be of much help.

#Hack The Box#Sherlock#DFIR#UAC Triage+2

Read Writeup

BLUEHack The Box2026-10-265 min read

PhantomBundle

A targeted phishing campaign has been identified affecting S1rBank customers across the Middle East, with initial compromise achieved through social media vectors. The deployed malware establishes C2 communication, enabling threat actors to execute remote commands including fraudulent notifications, overlay attacks for credential harvesting, and sensitive data exfiltration.

#Hack The Box#Sherlock#DFIR#Phishing+3

Read Writeup

BLUEHack The Box2026-10-265 min read

KeyDis

An HTB employee installed what appeared to be a legitimate application downloaded from the internet. Moments after execution, a Command Prompt window flashed on the screen, and the SOC detected abnormal outbound network activity from the affected host. The incident was escalated to the DFIR team, which successfully acquired the suspicious executable. Your task is to analyze the recovered binary, uncover its behavior, and determine the techniques used by the malware.

#Hack The Box#Sherlock#Malware Analysis#Reverse Engineering+2

Read Writeup

BLUEHack The Box2026-10-265 min read

Arcadia's Compromise

Arcadia Interactive is a mid-sized enterprise that supports remote administration of internal workstations via RDP. Late one evening, Arcadia's SOC detected suspicious activity from an internal host and abnormal login patterns. The incident response team suspects RDP was involved, but the scope is unclear. Analyze the provided artifacts and reconstruct the compromise.

#Hack The Box#Sherlock#DFIR#RDP Forensics+2

Read Writeup

BLUEHack The Box2026-10-205 min read

TaskForce

Threat intelligence teams identified an active threat group leveraging abused Windows Task Scheduler engine to execute beaconing implants under legitimate system service accounts. Reconstruct the full timeline and eradication steps.

#Hack The Box#Sherlock#DFIR#Scheduled Tasks+2

Read Writeup

BLUEHack The Box2026-10-205 min read

CAMouflage

Suspicious outbound traffic was detected from surveillance network segment. Analysis revealed attempts to hijack internal video streams and utilize camera firmware as a staging proxy. Conduct full forensic triage on the network captures and system logs.

#Hack The Box#Sherlock#DFIR#IoT Security+2

Read Writeup

BLUEHack The Box2026-09-105 min read

Phantom

A Linux server in your organization has been exhibiting suspicious behavior. Network monitoring detected unusual outbound connections to an unknown IP address, and system administrators noticed that several standard diagnostic commands were returning incomplete information. A memory dump was captured from the compromised server before isolation. Your task is to analyze this memory dump to uncover evidence of a sophisticated rootkit infection, map its capabilities, and document all indicators of compromise.

#Hack The Box#Sherlock#DFIR#Memory Forensics+3

Read Writeup

BLUEHack The Box2026-09-105 min read

Midnight Crash

A critical Windows database server suffered a Blue Screen of Death (BSOD) at midnight during scheduled maintenance. Preliminary review indicates the crash was triggered intentionally by rootkit activity attempting to bypass active kernel telemetry.

#Hack The Box#Sherlock#DFIR#Crash Dump+2

Read Writeup

BLUEHack The Box2026-09-105 min read

LogForge

Investigation into a targeted exploitation attempt against enterprise web applications utilizing the Log4Shell vulnerability. The adversary attempted remote code execution through JNDI LDAP lookup strings to establish interactive shells.

#Hack The Box#Sherlock#DFIR#Log4Shell+3

Read Writeup

BLUEHack The Box2026-09-095 min read

WhaleSecret

Our team was called in to investigate a security incident of an internal web application. The only thing we know is that the web application was running on docker. The team acquired triage data as well as an important folder from the docker running the exploited service. Your task is to investigate the incident.

#Hack The Box#Sherlock#DFIR#Docker Forensics+2

Read Writeup

BLUEHack The Box2026-09-095 min read

Oldie

Applications remain one of the most significant risks to enterprise environments. In a recent incident, a ransomware attack was detected on our client's Linux server, triggering an immediate alert. The affected system was quickly isolated, and a triage process was initiated to analyze the ransomware payload and restore business operations.

#Hack The Box#Sherlock#DFIR#Ransomware+2

Read Writeup

BLUEHack The Box2026-09-095 min read

Kraken

Our SOC detected an emerging RAT variant delivered via malicious file execution in its early stages, triggering an alert before C2 communication was fully established. Rapid containment prevented further exfiltration or post-exploitation activities. A full forensic triage was conducted to analyze persistence mechanisms and C2 infrastructure, enabling comprehensive IOC extraction.

#Hack The Box#Sherlock#DFIR#RAT Analysis+3

Read Writeup

BLUEHack The Box2026-09-085 min read

CorpDown-2

A security breach was detected on TriDsk-WKS01 shortly after an employee returned from vacation. The threat actor observed IR interference and adapted their operations, accelerating lateral movement across the corporate network, deleting backups, and exfiltrating data, culminating in a Corp Down scenario.

#Hack The Box#Sherlock#DFIR#Active Directory+2

Read Writeup

BLUEHack The Box2026-09-075 min read

VelvetThrone

Axiom Financial Partners, a private equity firm managing $4.2 billion in assets, has suffered a significant breach. Initial triage suggests that an external threat actor gained initial access through an identity provider compromise and subsequently deployed custom malware, performed credential theft, and exfiltrated sensitive M&A documents.

#Hack The Box#Sherlock#DFIR#Identity Provider+3

Read Writeup

BLUEHack The Box2026-09-025 min read

Kawmikaze

Following the recent breach at ShanoCorp, a suspicious binary was recovered from one of the systems where endpoint protection was disabled. Investigators determined that the process executed with elevated privileges. Reverse engineer the malware to uncover its internal capabilities and impact.

#Hack The Box#Sherlock#Malware Analysis#Reverse Engineering+2

Read Writeup

BLUEHack The Box2026-08-305 min read

Baggage

This Sherlock provides players with an opportunity to analyze Shellbag artifacts. Shellbags can be used to find evidence of folder access by a specific user, access to network shares, and navigation of archive file contents. This information can be leveraged during investigations to identify potential data access, data staging, and data exfiltration attempts.

#Hack The Box#Sherlock#DFIR#Shellbags+2

Read Writeup

BLUEHack The Box2026-08-015 min read

Stonks

A major real estate and development corporation is under investigation for large-scale financial fraud. Law enforcement has seized a corporate server believed to store critical documents that were deleted in an attempt to cover up the fraud. Recover the missing artifacts and uncover the truth.

#Hack The Box#Sherlock#DFIR#Financial Fraud+2

Read Writeup

BLUEHack The Box2026-08-015 min read

ShadowMonarch

Alerts triggered indicating unconstrained delegation abuse and Kerberos ticket manipulation within an enterprise domain. The adversary utilized stealthy Shadow Admin permissions to maintain persistent administrative control.

#Hack The Box#Sherlock#DFIR#Active Directory+3

Read Writeup

BLUEHack The Box2026-07-195 min read

PhantomRing

Your organization's SOC team intercepted a suspicious binary during a routine threat hunting operation on a Linux server. The file was found in /var/tmp with an unusual name and was attempting to establish outbound connections. Initial analysis suggests this could be a post-exploitation agent. Your task is to perform static analysis on the binary to identify its capabilities, extract indicators of compromise, and understand the threat actor's infrastructure.

#Hack The Box#Sherlock#Malware Analysis#Linux Forensics+2

Read Writeup

CTFOverTheWire2026-04-285 min read

OverTheWire: Bandit & Leviathan Security Analysis

A Blue Team and DFIR perspective on analyzing Linux binary exploitation, privilege escalation, and logic flaws through OverTheWire's Bandit and Leviathan wargames.

#overthewire#bandit#leviathan#linux+5

Read Writeup

BLUECyberDefenders2026-03-255 min read

Yellow RAT

Analyze malware artifacts using threat intelligence platforms like VirusTotal to identify IOCs, C2 servers, and understand adversary tactics.

#threat-intel#cyberdefenders#blue#red-canary+4

Read Writeup

BLUECyberDefenders2026-03-255 min read

Lespion

Investigate an insider threat by analyzing GitHub repositories for exposed credentials, using OSINT tools to correlate online accounts, and performing image analysis to identify locations.

#threat-intel#cyberdefenders#blue

Read Writeup

BLUEBTLO2026-03-225 min read

Veriarty

DI Lestrade has intercepted a transmission from a criminal known as Moriarty. He's asked his good buddy Sherlock Holmes and John Watson (that's you) to use their skills as investigators to work out what he's up to.

#Veracrypt#BTLO#gpg#email

Read Writeup

BLUECyberDefenders2026-03-225 min read

Amadey Writeup

Analisis memory dump Amadey Trojan menggunakan Volatility3 untuk mengidentifikasi proses berbahaya, komunikasi C2, pengiriman payload, dan mekanisme persistensi.

#cyberdefenders#forensic#endpoint-forensic#blueteam+1

Read Writeup

CTFK17 CTF2026-01-235 min read

K17 CTF: Daily Re - WASM Static Analysis

#Reverse Engineering#WASM#Python#Static Analysis

Read Writeup

CTFFGTE CTF2025-10-095 min read

Activation

Membongkar aplikasi .NET (Activation.exe), menganalisis algoritma HMAC-SHA256 & AES, serta membuat solver otomatis.

#.NET#Reverse Engineering#ILSpy#Cryptography+3

Read Writeup

REDHack The Box2025-01-045 min read

Trickster

Eksploitasi menyeluruh mesin Linux Trickster (Hack The Box): Git repository dumping, chaining PrestaShop XSS to RCE (CVE-2024-34716), pivoting Docker container via changedetection.io SSTI (CVE-2024-32651), dan eskalasi hak akses Root melalui PrusaSlicer G-code injection.

#Hack The Box#Red Team#Linux#Prestashop+5

Read Writeup

Legacy Operations

Access the declassified archive of previous experiments, lab notes, and early defensive protocols hosted on the old secure server.

ACCESS Here !!