LetsDefend: WannaCry Ransomware

LetsDefend rated this challenge as Medium in difficulty. This Blue Team challenge can be accessed at https://app.letsdefend.io/challenge/wannacry-ransomware. I answered the questions in this challenge using the tools Volatility, Oletools, and FTK Imager. I used 2 separate VMs for my analysis. One is a Remnux VM for memory analysis, and the other is a Windows 11 VM to analyze a …

LetsDefend: Adobe ColdFusion RCE

Servers utilizing Adobe ColdFusion were exploited in the wild. LetsDefend rated this challenge as Medium in difficulty. This Blue Team challenge can be accessed at https://app.letsdefend.io/challenge/adobe-coldfusion-rce. I answered the questions using the tools Hayabusa, Timeline Explorer, CyberChef and PowerShell. Scenario: A web server was isolated for suspicious use of the nltest.exe command. Investigate the Windows …

Why I Think Security Blue Team’s BTL1 Certification is the Gold Standard for SOC Analysts

The good stuff first I woke up at 4:30 AM to take a leak, and just had a feeling to check my email quick before jumping back to bed. And then I saw the best email I could ever wish for from Security Blue Team: Needless to say, I was not able to go back …