Pick a lab
Every one of these is safe: harmless test files, made-up domains, or my own lab infrastructure. Pick whichever sounds fun!
Your First IOC Lookup
Run a harmless test file through VirusTotal and read the report like an analyst would. Totally safe, and honestly the fastest way to make IOCs click!
Pivot or Pitfall?
Eight artifacts from a made-up phishing page. For each one, make the call: strong pivot, supporting clue, or pitfall? Then see what your choices did to your investigation (it can get ugly lol).
The Pivot Hunt
Start at ctijen.com and follow three real pivots through my own lab infrastructure to the flag at the end.
Write a Profile in an Hour
Set a timer, pick a well-reported group, and walk out with a finished first draft of a threat actor profile: alias table, Diamond Model, TTPs, and an exec summary. It's the first piece of your CTI portfolio!
Pivot Out in an Hour
Start with one domain from your threat actor profile and map the infrastructure around it: certificate transparency, SANs, passive DNS, and the JARM and JA4X fingerprints. All passive, and you end with a map you can put in your portfolio!
You tell me!
More labs are on the way. If there's a skill you want to practice, let me know below and it might be next.
Same rule as always: only do what your work policies allow. I don't want to be the reason you get a call from your SOC 😅
Are these helpful?
Labs are an experiment. If you like them, I'll build more, so tell me what worked, what didn't, and what you'd want to practice next.