A case comes in late on a Friday. You’ve got a triage collection off a compromised endpoint and you need somewhere to work it. So where does it go? For most of us the honest answer is “the same a...

The Call The call seemed legitimate. Someone claiming to be from their bank knew their name, verified their Social Security Number, and walked them through what sounded like a routine security iss...

Part 1: Prompt: In this post-webcast challenge, we are going to be looking into a malicious .eml file.`  Seriously, one would think we would have solved the whole email as an attack vector thing. ...

Introduction: In today’s cloud-driven world, Multi-Factor Authentication (MFA) has become the gold standard for securing Microsoft 365 accounts. While it blocks most traditional phishing attempts,...

Introduction: In January 2025, Fortinet disclosed CVE-2024-55591, a critical authentication bypass vulnerability affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 / 7.2.0 ...

Sherlock Scenario: In this Sherlock, you will familiarize yourself with Sysmon logs and various useful EventIDs for identifying and analyzing malicious activities on a Windows system. Palo Alto’s ...

Keeper is a simple machine focused on a helpdesk running Request Tracker with an admin running KeePass for password management. Default creds allow for the reconnaissance necessary to achieve init...