The Labs
Reading about CTI only gets you so far. These are free, safe, hands-on exercises you can do right now, no account or fancy platform required.
Pick a lab
Each one is built to be safe: harmless test files, made-up domains, and passive lookups only.
Your First IOC Lookup
Upload a harmless test file to VirusTotal and read the report the way an analyst would. It's completely safe, and it's the fastest way to make indicators click.
Pivot or Pitfall?
Eight artifacts from a made-up phishing page. Call each one a strong pivot, a supporting clue, or a pitfall before you see the answer, and watch what your choices do to your investigation.
The Pivot Hunt
Start at ctijen.com and follow three real pivots (a web request, a certificate log, and a file hash) through my own lab infrastructure to the flag at the end.
You tell me!
More labs are on the way. If there's a skill you want to practice, let me know below and it might be next.
Same rule as always: only do what your work policies allow. I don't want to be the reason you get a call from your SOC 😅
Are these helpful?
Labs are an experiment. If you like them, I'll build more, so tell me what worked, what didn't, and what you'd want to practice next.