Labs

A set of IAM policies for a small cloud account. Trace the path from a low-privilege identity to account control, state it as a path, and choose the edge to cut.

Two architectures for the same requirement. The expensive one prevents exactly one failure, and the question is whether that failure is worth £40,000 a year here.

Five workloads, their role bindings, and forty minutes of audit log. The workload that reached the node is not privileged, mounts nothing, and does not run as root.

Seven layers, a clean-looking Dockerfile, and a scanner leading with a critical finding that changes nothing. The secret is in a layer the running container does not have.

A release-signing key is being used from an address the organisation does not own. Source control, a backup, an operator export and a build log are all candidates. Three are innocent.

An admin API on mutual TLS accepted a certificate it should not have. It is not the scary self-signed one. That was rejected correctly. It is the one with a perfect chain, and the reason is what the CA and the API each failed to check.

A “secure vault” encrypts a secret with real AES, and keeps the passphrase in the config file beside the ciphertext. The crypto is not broken. It protects nothing. Recover the secret it was supposed to hide.

You recover the vault secret the easy way, then turn around and read what this host kept: the shell history and the file access times that show the passphrase was read and the ciphertext was decrypted.

You recover the vault secret, then write a detection that flags a config storing a passphrase beside its ciphertext, prove it fires on the vulnerable vault, and prove it clears a config that keeps its key in a secrets manager.

A purple exercise: 4769 telemetry from an emulated Kerberoasting run, with benign look-alikes and an evasion. Confirm the detection fires, stays quiet, and measure what the evasion costs.

A week of export-endpoint traffic with an attack hidden in it, and a blank page. Write a detection rule, run it against the whole log, and get its false positives to zero: the obvious indicator is in the business traffic too.

An internal preview tool serves reports by name and never checks the name stays in its own directory. Walk out of it to read a handover you were refused. Then read the log your own request wrote, and build the detection that catches it without flagging the ordinary previews.

Twelve authentication events across three hosts. One sequence is an adversary. Find it, and say what you can and cannot prove.

Encoded PowerShell on a workstation, a paste-site visit three minutes earlier, and a phishing email that morning. Each source alone tells you to reimage the machine. Read them against each other.

A morning queue sorted the way the console sorts it. The three alerts marked critical are an authorised test; the worst thing on the list is marked low.

The noisiest rule in the estate produced 2,983 alerts in ninety days and one confirmed incident. Four tunings are on the table. The one with the best-looking ratio suppresses the incident.

A five-stage intrusion ran for three days undetected, and the board was told the gap was analyst workload. Two of the five stages produced no usable telemetry at all. Find the blind spots, rank the fix, and test the claim.

A threat-intel report on a commodity loader arrives, and your customer runs the host in front of you. Decide whether it is affected, on what evidence, and which of the report’s indicators is worth nothing here, on purpose.

You take the SOC desk with a full queue and a clock. A scanner trips the IDS all night, the backup job looks like a brute force, the EDR reads LSASS by design, and one alert in the pile is an actual intrusion. Disposition the noise, find it, and prove it.

A week of office logins and one that does not belong. Learn the move every blue-team job is built on: you do not read a log, you ask it (who appears most, how many failed, and which one is the odd one out).

The same reporting host as the red lab, from the blue seat: take root through the world-writable maintenance script, then find what the box recorded of it, the changed script, its permissions, and the root-owned file the scheduled job made for you.

A process view from a memory image of a suspected-compromised host. Find the process running code it should not be, and separate what the image proves from what must be inferred.

A hypothesis, one query across 412 hosts, and no alert to start from. Two of the results are rare and harmless, one is common and harmless, and one is what the hypothesis predicted.

A hunt for WMI persistence across 412 hosts. Every result is accounted for, and reporting that correctly, with the right caveat, is harder than reporting an incident.

One incident, three decision points, and information arriving between them. Disabling the account is wrong at 02:14 and correct at 03:14, and nothing about the account changed.

Nothing alerted. A signed binary runs 22,000 times a week for good reasons, and on three hosts it has a parent it has nowhere else. Find the finding in the frequency table, not in any single row, and do not grab the rarest one.

A finished incident report going to a board on Friday, and the evidence register beside it. Most of it is good, which is what makes the two failures worth catching.

A disk image is about to be disclosed to a hostile expert. One discrepancy in the record looks alarming and is fine; one detail looks routine and is a genuine break. Find both, and say which is which.

A shell on a web host somebody has already been inside. Find how they got in, what they took, and what they left running.

A host is running something that shouldn’t be, and it is hiding in the process list under a kernel-thread name. A process can rename itself; it cannot hide the binary it runs or the process that started it. Read the tree, not the names.

Run a sleeping agent under a kernel-thread name so it slides past an eye skimming the process list, then see for yourself the two facts on the box that still give the disguise away.

Run the disguised agent, then write a detection that keys on a kernel-thread name carrying a real on-disk binary, prove it flags the impostor, and prove it stays silent on the sanctioned monitor and normal processes.

A shell on the same web host from the attacker's side: perform the path-traversal read that lifts the database credential, then inspect the scheduled job left behind that keeps the foothold across a restart.

A shell on the same web host after the intrusion: reproduce the path-traversal read, then author a detection that flags the traversal requests from one source and clears the ordinary browser traffic beside them.

Five messages, one morning. The one with a failed authentication check is legitimate, the obvious spoof was correctly quarantined, and the phish passed SPF, DKIM and DMARC. Work out how, and what that says about what those checks are for.

The only critical finding is on a host with no network route to anything. The one that matters is medium, on the payment path, with an exploit in circulation for eleven days.

A draft notification that understates one number, overstates one certainty, omits one unknown, and gets one sentence exactly right.

Four emails. The spoof of your own CEO failed every authentication check and was delivered anyway; a real vendor invoice failed SPF and looks like the threat. Read the headers, not the vibe, and say which is which, and why the spoof got through.

A real terminal, four small things to do, and nothing you can break. Read a file, find a file, search inside one, and check who you are. The point is not difficulty: it is stopping being afraid of the prompt.

Five tokens reached a payroll service in one morning and four were correctly rejected. The one that was accepted satisfied every check the service performs and was minted for something else entirely.

Eight answers on a supplier questionnaire. Two are unfalsifiable, two are true and irrelevant, one is contradicted by the evidence they attached themselves, and one is better than anybody asked for.

A portal that decides who you are from a cookie you hold. Log in with the one account you were given, read what the cookie actually says, and become an administrator you were never issued.

The forgeable portal from the defender chair: forge the admin cookie yourself, then prove from the login logic the host holds that the session was never issued and that any cookie claiming admin is crafted.

The forgeable portal again, now to defend for real: forge the admin cookie, then write a check that decodes a session role, flags the role login can never issue, and prove it fires on the forgery while clearing a genuine user session.

Enumeration output from a Linux host holds one path from an unprivileged account to root. Find it, state it as a path, and choose the edge to cut.

A web server is calling out to somewhere it should not. Forty files changed that night and most of them are a package update. Find the persistence, and find the file whose two timestamps disagree.

Four candidate audit rules, measured volumes for each, and an alert budget. The best coverage produces 2.1 million events a day; the best ratio catches the wrong event entirely.

A host reported twelve days late. auth.log has rotated past the window, the journal was volatile and the host has rebooted, and auditd was never installed. Establish what can still be established, and be exact about what cannot.

A shell on a host where a service account climbed to root through a file it should never have been able to change. Find the file, the account, and what root now runs that nobody approved.

You have root, three real audit findings, and a service that must still work when you are done. The fastest way to pass a permissions audit is to lock everything down; do that and you break the app. Fix exactly enough.

A sample that does nothing at all in a standard analysis environment, and installs a service in one that differs by a single property. Find the gate, and say what each half of the analysis missed.

A shell on an analysis host with a quarantined sample. No network, nothing to detonate, only what static triage gives you: what it talks to, what it dropped, and how it comes back.

On the same analysis host, study the captured sample and reproduce its behaviour in writable space: stage a hidden loader, embed a C2, attempt the beacon, and lay the scheduled re-run.

Reproduce the dropper on the analysis host, then author a detection that fires on the hidden staged loader and stays silent on ordinary files, proving it with a true positive and a true negative.

Two hours of resolver logs, one connection summary, and a tunnel-detection rule that was already deployed and did not fire. Find the channel, prove the direction, and explain the miss.

Eight hours of outbound TLS from one workstation. No payload is available and none is needed: the most metronomic connection here is legitimate, and the one that matters jitters.

An external notification names one address for four thousand machines. Three collectors recorded the same ninety seconds and each distorts it differently.

A card-data environment is attested as isolated from the corporate network, enforced by one explicit deny rule. The rule works. The isolation does not: a two-hop path is open, and the flows show it has been used.

A shell on a host with something still running on it. Find the process that does not belong, where it calls home, and what starts it on boot.

A day of DNS queries, and one internal host quietly exfiltrating files over them a few bytes at a time. Find it on volume, entropy, and a record type nobody’s browser needs. Then read what it took, because base32 is not encryption.

You are the operator: take a short file list, encode it into base32 subdomain labels, and shape the DNS queries that would carry it off the host past every control that never inspects DNS.

Reproduce the DNS tunnel in the resolver log, then author a detection that fires on the exfiltrating host and stays silent on a day of ordinary queries, proving both the true positive and the true negative before you write it up.

On the same beacon host, build the attacker's side yourself: a config-driven agent that phones home on a fixed interval from a path no package owns, plus the boot service that would bring it back, staged in the box's writable /tmp.

On the beacon host, run the attack and then engineer its detection: reproduce a config-driven agent that checks in on a fixed interval, write a rule that keys on that interval, and prove it catches the beacon while clearing normal activity.

A red team ran five techniques against an estate whose coverage matrix marked all five covered. Two produced no alert, one produced an alert for the wrong reason. Find all three, and say what "covered" should have meant.

Eight recorded events, five of which are an intrusion. They map onto five techniques across five tactics, and a sixth tactic must have happened and left nothing. Work out why.

One compromised workstation, four credentials, five destinations. Work out which an adversary reasoning about cost would take, and therefore which the defender should close first.

Six honeytoken placements, an attack-path graph, and the trip counts from a red-team exercise. You may keep two. The one that fired most is the one to cut, and the one that fired once is the one that worked.

A shell on a host as the unprivileged analyst account, and a warehouse credential in /root you cannot read. Root cron runs a maintenance script every minute, and a backup change nobody reviewed left that script world-writable. Rewrite it, wait for the tick, and take what your account was refused.

The same host as the red lab, from the purple seat: take root through the world-writable maintenance script, then prove where a detection belongs, since watching the job file for an illegal change catches it and watching for a privileged process cannot.

Application logs and a code excerpt from a reported incident. Confirm whether SQL injection occurred, locate the sink, and recommend the fix that removes the class.

An application is being exploited through its URL-import feature. A firewall rule was deployed mid-incident and the alerts stopped. Work out what happened after that, and choose a fix that survives an attacker who reads it.

A day of application logs in which nothing failed. No errors, no anomalies, no 403s, because the check that would have produced one was never written.

An injection was reported, four patches were proposed, and every one of them defeats the payload in the report. Decide which one actually fixes the application, and what proof would have told you without asking.

A shell on an application host after someone read other people's invoices. The source is on the box. Find the route that never asks who is calling, the field it should have compared, and the address that walked the ids.

A shell on a host that runs an internal export tool. The tool checks a destination before it queues a report, and it does it by handing your input to a shell. Prove it, and reach what your own account cannot.

The same export host as the red lab, from the blue seat. Run the command injection yourself, then read the check log the tool writes and pick your own request out of a week of ordinary destination checks. The bug is real; this time the job is to recognise it after the fact.

The same export host as the red lab, from the purple seat. Run the command injection, then write a log-scan detection for it and prove it fires on your attack and stays quiet on a week of ordinary destination checks. The exercise is the signature: what makes it robust rather than brittle.

A shell on the billing host where one authenticated route returns any invoice by id without checking who is asking; confirm the flaw in the source and show how far walking the ids reaches.

A shell on the billing host after a caller read invoices that were not theirs; reproduce the id walk from the source and log, then write a detection that flags one source pulling sequential ids while clearing an ordinary profile read.

Endpoint protection, a backup agent, and one more process all read LSASS on the same host in the same hour. Decide which is the incident, prove it from the process tree, and explain why the other two are not.

A directory export where every row is unremarkable and three of them compose into a path from a helpdesk account to the domain. Find it, and say which edge to cut.

A detection nobody has the definition for. Eight alerts, four comparable events that produced nothing, and a change record that describes a rule this is not.

SMB signing is attested as required on all servers, verified by opening the domain GPO. On the file servers the control exists to protect, the effective setting is the opposite, and the gpresult proves it.