A step-by-step SOC analyst guide to detecting and analyzing Insecure Direct Object Reference (IDOR) web attacks on the LetsDefend platform.

In the previous room, we took the offensive route — playing the attacker, brute-forcing directories, and altering bank balances.

How an attacker took over a mailbox without stealing a password, what the logs showed, and how we shut the door.

Scenario :You have been presented with the opportunity to work as a junior DFIR consultant for a big consultancy. However, they have…

Introduction

Introduction

Here’s a counterintuitive truth: the ultimate goal of threat hunting isn’t to find more security incidents—it’s to drive continuous improvement across your entire security program. We’re not hunting merely to find present bad; we’re hunting to decrease the…

Tracing a phishing email through compromised websites, Cloudflare Workers, and a modular device-code phishing kit with striking…

Active Directory environments often contain legacy configurations that can introduce unexpected security risks. One such issue is Group…

When people hear the word cybersecurity, they often imagine hackers typing commands on dark screens, trying to break into systems.

Yesterday, we explored Account Compromise and how attackers can abuse stolen or compromised identities.

Description: A process left traces in memory. Analyze the evidence and uncover what the malware was set to do.

Author: Davud Qasimov

Hello.

Hello.

前言： 本篇是 Cobalt Strike 系列的最後一篇，經過上篇了解了 Cobalt Strike 的基本架構與 Beacon 的運作，到中篇的調查分析，接下來本篇將會介紹最後尚未說明但卻也是攻擊鏈中必要的一環，就是 Beacon 的提權與後續 PtH…

Introduction

Hello.

Room: Handbook for the Recently Compromised Platform: TryHackMe Difficulty: Easy Category: Windows Forensics / Log Analysis