Archive
Incident teardowns, detection engineering, reverse engineering and network forensics.
For somebody who is new to this and does not want to be talked down to. Frameworks, method, and the vocabulary the rest of the archive assumes.
Every other lab here asks for a virtual machine. This one asks for a terminal. Pre-recorded event logs, a cross-platform parser, and the same reasoning, on whatever laptop you already have.
The first lab for a machine of your own. You create the evidence yourself, delete a file from it, and then recover the file you deleted, which is the only way to be certain the recovery worked.
A first investigation for anyone who has read about persistence but never gone looking for it. You will plant a Run key with Atomic Red Team, then find it three different ways and work out which of the three you would actually trust in production.
A beginner's guide to MITRE ATT&CK that does not open with the matrix. What it is, what it is not, why the giant grid is the worst way to meet it, and how to use it on a Tuesday afternoon rather than in a strategy deck.
Plant a scheduled task with Atomic Red Team, then find it four ways and work out which one survives an attacker who names their task properly. Closes the loop on the persistence you found on the domain controller in the Northwind case.
Six months of a detection lab that was impressive to look at and useless to work in, and the four changes that fixed it.
