CyberDefenders Labs

CyberDefenders runs realistic blue-team CTF challenges built around real forensic artifacts — memory dumps, PCAPs, phishing kits, and registry hives. Every lab below was solved end-to-end and documented question by question.

9
Labs completed
5
Categories covered
100%
Questions answered
cyberdefenders

All CyberDefenders labs

Every CyberDefenders blue-team CTF lab solved so far, with full methodology, real commands, and real screenshots.

CYBERDEFENDERS · RETIRED RedLine Lab Endpoint Forensics · Memory Analysis · Easy $ vol -f MemoryDump.mem windows.malfind tools: Volatility 3 · Strings
CyberDefenders · Endpoint Forensics · Easy
RedLine Lab
Volatility memory forensics — process hollowing, a hidden Outline VPN tunnel bypassing NIDS, and full C2 attribution from a single memory image.
read writeup ↗
CYBERDEFENDERS · T1110.003 T1110-003 Threat Hunting · Password Spraying · Easy index="t1110-003" "event.code"=4625 tools: Splunk · ELK
CyberDefenders · Threat Hunting · Easy
T1110-003
Splunk threat hunting for an RDP password-spray attack — timing the bruteforce window, identifying compromised accounts, and mapping detection to MITRE T1110.003.
read writeup ↗
CYBERDEFENDERS · RETIRED Sysinternals Lab Endpoint Forensics · Trojanized Software · Medium $ AmcacheParser.exe -f Amcache.hve --csv . tools: Autopsy · AmcacheParser · VirusTotal
CyberDefenders · Endpoint Forensics · Medium
Sysinternals Lab
A trojanized SysInternals download traced through Amcache/AppCompatCache artifacts to a Rozena downloader, its C2 domain, and a fake Windows service used for persistence.
read writeup ↗
seed phrase ••• ••• ••• ••• CYBERDEFENDERS · RETIRED GrabThePhisher Threat Intel · Crypto Wallet Phishing · Easy $ cat metamask.php tool: text editor · exfil: telegram bot
CyberDefenders · Threat Intel · Easy
GrabThePhisher Lab
Source-level analysis of a live crypto wallet phishing kit — mapping its geolocation lookup, harvested seed phrases, and Telegram exfiltration channel back to the developer.
read writeup ↗
CYBERDEFENDERS · RETIRED PhishStrike Threat Intel · Email Header Analysis · Medium spf=softfail dkim=fail C2: gh9st.mywire.org tools: URLhaus · VirusTotal · MalwareBazaar · VMRay
CyberDefenders · Threat Intel · Medium
PhishStrike Lab
A spoofed invoice email traced through a full malware delivery chain — CoinMiner, BitRAT, and AsyncRAT — down to their C2 domains and a Telegram exfil bot.
read writeup ↗
CYBERDEFENDERS · RETIRED PoisonedCredentials Network Forensics · LLMNR/NBT-NS Poisoning · Easy $ llmnr and ip.src == 192.168.232.162 tool: wireshark
CyberDefenders · Network Forensics · Easy
PoisonedCredentials Lab
LLMNR/NBT-NS poisoning traced purely from a packet capture — identifying the rogue host, every poisoned victim, and the NTLM account it compromised.
read writeup ↗
CYBERDEFENDERS · RETIRED PsExec Hunt Network Forensics · Lateral Movement · Easy $ smb2.tree contains PSEXESVC tool: wireshark
CyberDefenders · Network Forensics · Easy
PsExec Hunt Lab
Tracing PsExec lateral movement across two hosts in Wireshark — entry point, compromised credentials, service install, and the ADMIN$/IPC$ share chain.
read writeup ↗
.msg CYBERDEFENDERS · T1598.002 Dragonfly Lab Endpoint Forensics · Spearphishing for Info · Easy $ oledump.py -p plugin_msg.py T1598.msg tools: oledump · outlookspy · cyberchef · python
CyberDefenders · T1598.002 · Easy
T1598.002 Dragonfly Lab
A spearphishing MSG parsed with oledump — sender SPF analysis, a password-protected ZIP, and a malicious LNK-to-regsvr32 delivery chain.
read writeup ↗
CYBERDEFENDERS · RETIRED Yellow RAT Threat Intel · Yellow Cockatoo RAT · Easy C2: https://gogohid[.]com/gate?q=ENCODED_HOST_INFO tools: VirusTotal · Red Canary
CyberDefenders · Threat Intel · Easy
Yellow RAT Lab
Pure threat-intel pivoting from a single hash to full attribution — Yellow Cockatoo RAT, its persistence artifact, and its C2 infrastructure.
read writeup ↗