Drills
Practice drills for DFIR recall, evidence reads, and rule writing. Each one is graded in the page.
Read the Evidence
You get an artifact or a log, and you say what it shows.
-
CloudTrail Triage
Read AWS CloudTrail records, and decide what the identity was actually doing.
-
PCAP Triage Drill
Work one capture from scope to beacon through conversations, DNS, HTTP, and TLS. The PCAP tool's own parser checks the answers.
-
Phishing Headers
Pull the deciding values out of raw email headers, and say what they establish.
-
Timeline Reconstruction
Order findings from mixed sources, and say which artifact could answer the question at all.
-
Collection Order
Order what you collect for a scenario, and say what each choice costs.
-
Linux Triage
Read Linux evidence, say who did what, and say what it cannot tell you.
-
Registry Artifacts
Say what a Registry finding proves, and what it only appears to prove.
-
Identity Attack Triage
Name the identity attack from the logs, then pick the containment that works.
-
Windows Event IDs
Read a raw Security or Sysmon entry, and pull out the fields triage actually turns on.
-
Decode & Convert Drill
Identify an opaque value as a timestamp format or an encoding, then read it. The site's own converter and codecs generate every value.
Build a Rule or Query
You write something and keep editing it until it passes real test cases.
-
RegEx Range
Build a working pattern against real sample text, one construct at a time.
-
Query Pipeline Drill
Put KQL and SPL pipeline stages in the order that works: filters before aggregations, and sort before truncate.
-
YARA Rule Drill
Write a YARA rule that matches the right samples and stays quiet on the rest. The YARA Tester's engine grades it live, including samples you never see.
-
Sigma Rules
Write a detection rule that fires on the events that matter and stays quiet on the ones that do not.
-
Terminal Commands
Run real investigative commands against a simulated host in bash, cmd, or PowerShell.
Recall & Calculate
Fast recognition, plus the arithmetic that has to be right the first time.
-
Timestamps
Read a bare integer for what it is, and say what the wrong epoch would have produced.
-
MITRE ATT&CK
Name the technique behind a real, documented procedure, and put an intrusion back in order.
-
Hash Identification
Identify a hash by its length and shape, and sort algorithms by what they are still safe for.
-
Subnetting
Work out what a CIDR block actually contains, and which special-use range an address falls in.
-
Network Reference Drill
Quick recall of the ports, HTTP status codes, and DNS record types that come up in triage. The questions come from the same tables as the reference pages.
-
CVSS Scoring Drill
Read a real vulnerability, and pick the eight CVSS v3.1 Base metrics that score it. Every answer is FIRST.org's published vector, scored by the same code as the calculator.
-
Threat Actor / APT
Resolve aliases and tooling to the group behind them, and tell similar actors apart.