Lockdown LabCyberDefenders Lab Scenario TechNova Systems’ SOC has detected suspicious outbound traffic from a public-facing IIS server in its cloud platform—activity suggestive of a web-shell drop and covert connOct 14 · 20 min readiluvblue.hashnode.dev
DanaBot LabAnalyze network traffic using Wireshark to identify DanaBot initial access, deobfuscate malicious JavaScript, and extract IOCs like IPs, file hashes, and execution processes. Here is a link to the labOct 10 · 4 min readiluvblue.hashnode.dev
Reference Document -> RMMI got these emails from an insurance company: First one from the agent: From the company itself: The emails addresses were legitimate addresses because I had corresponded with them before. HoweverOct 3 · 10 min readiluvblue.hashnode.dev
Zillow Listing to RMMZillow Listing -> "Virtual Tour" -> Fake Zoom Url Analysis While looking for apartments, someone sent me a link to a "virtual tour" of the apartment. They said it was via zoom. This was not a zoom linSep 24 · 5 min readiluvblue.hashnode.dev
Emulation FTW!Sample from Samplepedia Goal: Extract the next stage download url # File Information File Type: Microsoft Encrypted Structured Storage Object || CDFV2 Encrypted CDFV2 Encrypted indicates that a MicroSep 23 · 9 min readiluvblue.hashnode.dev
