The artifact zoo

Packet captures, event logs and memory images to practise on, in password-protected archives with a published hash. Every pack says whether anything inside it can run.

Every pack states whether anything inside it can run, publishes its SHA-256 before you download it, and carries a provenance stamp: CONSTRUCTED evidence was generated to teach, REAL evidence was captured from a system.

1 in all

Inert evidenceCONSTRUCTED

DNS with something in the labels: a small constructed capture

Sixty DNS queries from one workstation, fifteen of them TXT lookups whose first label is 56 characters of base32. Small enough to read packet by packet, and generated by a script, so nothing in it came from a real network.

pcapother

T1071.004T1048.003

2.9 KB2 files