// portfolio metrics

Lab Portfolio Stats

Wiki generated 2026-10-15 · 538 pages · auto-generated from Obsidian vault

// About this page
This is an auto-generated snapshot from my Obsidian vault. Surfaces patterns across 209 labs, 123 SOC alerts, and a 538-page wiki covering 66 malware families, 22 threat actors, and 274 MITRE techniques. Full writeups at /blue-team/labs.

209

Labs Completed

BTLO Labs

CyberDefenders

Malware Families

280

Lab MITRE Techs

274

Wiki TTP Pages

Platform & Difficulty

Platform Split

BTLO

CyberDefenders

Other

Difficulty Breakdown

Easy

Medium

Hard

Hard: secure shell · You're Hired! · First Week · Insider Threat · Dumpster · Fake · Supply Drop 1 · MailFall · TxDrop · Formbook · RoastToRoot · MarkShell - TA577 · Code Blue - APT29 · Recruiter - Hanoi Op · Maromafix Falldown - RansomHub · Spooler - APT28 · Phantom Pixels · Gh0stNet Intrusion · CryptLoad · Renegade · Hollow Chapter · Ancientland Breach - LockBit · Graphi · From SEO Poisoning to Custom RMM and Cobalt Strike — Incident Response (Case 2/4) · From SEO Poisoning to Custom RMM and Cobalt Strike — Detection Engineering (Case 3/4) · Inherited · Poisoned Pipeline

Categories & Tools

Top Categories

Incident Response

Endpoint Forensics

Threat Hunting

Threat Intelligence

Network Forensics

Malware Analysis

Cloud Forensics

Detection Engineering

Most Used Tools

Wireshark

VirusTotal

CyberChef

Sysmon (System Monitor)

KQL (Kusto Query Language)

Splunk

MFTECmd

Timeline Explorer

MITRE ATT&CK Coverage

Tactics by Wiki Source Count

Defense Evasion437

Execution231

Command & Control199

Persistence194

Credential Access183

Initial Access163

Discovery118

Collection77

Impact57

Exfiltration56

Lateral Movement55

Privilege Escalation33

Reconnaissance8

Resource Development7

Malware Families Investigated

Confirmed Families — 66 Total

IcedIDBanking Trojan / Loader

Cobalt StrikePost-exploitation C2

QBotBanking Trojan / Loader

EmotetBanking Trojan / Loader

AndromedaLoader

REvilRansomware / RaaS

XWormRemote Access Trojan

DanaBotBanking Trojan

LockBitRansomware

LummaStealerInfo Stealer

RamnitBanking Trojan

UrsnifBanking Trojan / Loader

XMRigCryptominer

AmadeyInfo Stealer

MiraiBotnet

AsyncRATRemote Access Trojan

BeaverTailLoader

DonutLoaderInfo Stealer

EtherRATRemote Access Trojan

InvisibleFerretInfo Stealer

Lynx RansomwareRansomware / RaaS

RansomHubRansomware / RaaS

AkiraRansomware / RaaS

AniviaCRTInfo Stealer

BPFDoorMalware

BreakWinMalware

clay_ClientRemote Access Trojan

CovenantPost-exploitation C2

CryptLoadLoader

DarkTortillaLoader

DenisMalware

EdgeSavedPasswordsDumperInfo Stealer

Gh0st RAT / FarfliRemote Access Trojan

GRAPHIMalware

HiddenTearRansomware

HyperScrapeMalware

Interlock RansomwareRansomware

InterlockRATRemote Access Trojan

JADESNOWLoader

KinsingRootkit

MatanbuchusLoader

MazeRansomware

MintLoaderLoader

MoziBotnet

NerisBotBanking Trojan

NimbusWiperMalware

NokoyawaRansomware / RaaS

NukeSpedMalware

OtterCookieInfo Stealer

PawsRunnerLoader

PureLogsInfo Stealer

Quasar RATRemote Access Trojan

RedLine StealerInfo Stealer

RedTailBotnet

Rhadamanthys StealerInfo Stealer

RoguePlanet / RoguePlanetV2Malware

Shai-HuludWorm

SILENTBUILDERMalware

StrelaStealerInfo Stealer

TeamPCP PayloadInfo Stealer

TeslaCryptRansomware

VodkaStealerInfo Stealer

WinPwnPost-exploitation C2

WSHRATRemote Access Trojan

XLMRatRemote Access Trojan

ZoomSetupCoreLoader

Notable Specialty Labs

APT / Nation-State

Gothic Panda series · andromeda-bot-unc4210 · revil_gold

Cloud Forensics

awsraid · azurehunt · rogueazure · spilledbucket

Supply Chain

3cxsupplychain · npm_supply_chain_attack

Memory Forensics

amadey · latent · firstweek · volatilitytraces

Ransomware IR

raasunfold · revil_gold · maranhao · ramnit

Unique Scenarios

containerbreak (escape) · androidbreach (mobile)

LetsDefend — SOC Alert Triage

123

Alerts Investigated

87.0%

True Positive Rate

Critical Severity

CVEs Investigated

101

MITRE Techniques

Alert Categories

Phishing / Social Eng.

Brute Force / Auth

Malware Execution

Web App / CVE Abuse

LOLBin / Binary Abuse

C2 / RAT / Backdoor

Data Exfiltration

Ransomware

Persistence

Privilege Escalation

Network Threats

Severity Split

Critical

High

Medium

Low

Outcome

True Positive

107

False Positive

CVEs Investigated — 40 Total

CVE-2024-3400 · Palo Alto PAN-OS GlobalProtect Comm… 10.0 Critical

CVE-2025-29927 · Next.js Middleware Authorization B… 9.1 CRITICAL

CVE-2021-1675 · 1675 / CVE-2021-34527 — PrintNightm… N/A

CVE-2023-46604 · Apache ActiveMQ OpenWire Deseriali… 10.0 CRITICAL

CVE-2024-35250 · Windows Kernel-Mode Driver Elevati… N/A

CVE-2025-55182 · Next.js Server Actions Prototype P… N/A

CVE-2017-9841 · PHPUnit eval-stdin.php RCE 9.8

CVE-2018-13379 · Fortinet FortiOS SSL VPN Path Trav… 9.8 Critical

CVE-2020-1472 · ZeroLogon (Netlogon Privilege Escal… 10.0 Critical

CVE-2021-22986 · F5 BIG-IP iControl REST Unauthenti… 9.8 Critical

CVE-2021-3156 · Sudo Baron Samedit (Heap Buffer Ove… 7.8 HIGH

CVE-2021-41773 · Apache httpd 2.4.49 Path Traversal… 7.5

CVE-2021-42013 · Apache httpd 2.4.50 Path Traversal… 9.8

CVE-2021-44228 · Log4Shell (Apache Log4j2 JNDI RCE) 10.0 Critical

CVE-2022-30190 · Follina (MSDT Remote Code Executio… 7.8 HIGH

CVE-2022-41082 · Microsoft Exchange Server RCE (Pro… 8.8 High

CVE-2023-22515 · Atlassian Confluence Broken Access… 10.0 Critical

CVE-2023-32315 · Openfire Path Traversal (Authentic… 7.5 HIGH

CVE-2023-3824 · PHP Stack Buffer Overflow (RCE) 9.8 Critical

CVE-2023-4966 · Citrix Bleed (Citrix NetScaler ADC/… 9.4 Critical

CVE-2024-1086 · Linux Kernel Netfilter Use-After-Fr… 7.8 HIGH

CVE-2024-24919 · Check Point Security Gateway Arbit… 8.6 High

CVE-2024-4577 · PHP-CGI Argument Injection (Windows… 9.8

CVE-2024-49019 · ADCS Certificate Template Privileg… N/A

CVE-2024-7399 · Samsung MagicInfo Premium Unauthent… N/A

CVE-2024-9264 · Grafana Remote Code Execution via D… N/A

CVE-2025-21298 · Windows OLE Zero-Click Remote Code… 9.8 Critical

CVE-2025-24071 · Windows Explorer NTLM Hash Disclos… N/A

CVE-2025-24813 · Apache Tomcat Partial PUT Java Des… N/A

CVE-2025-31161 · CrushFTP Authentication Bypass N/A

CVE-2025-32463 · Local Privilege Escalation via sud… N/A

CVE-2025-52691 · SmarterMail Unauthenticated File W… N/A

CVE-2025-53770 · SharePoint ToolShell Auth Bypass +… 9.8 Critical

CVE-2025-61155 · GameDriverX64.sys Anti-Cheat Drive… N/A

CVE-2025-69691 · pfSense XMLRPC Authenticated RCE N/A

CVE-2025-8088 · WinRAR Zero-Day Path Traversal N/A

CVE-2026-31431 · Linux Kernel AF_ALG Logic Bug ("Co… N/A

CVE-2026-41940 · cPanel/WHM Pre-Authentication CRLF… N/A

CVE-2026-42980 · Windows WMI Kernel Integer Underfl… N/A

HID-PSA-2025-002 · HID-PSA-2025-002 — HID ActivID S… N/A

Threat Actors Tracked — 22 Total

Lazarus Group North Korean Nation-State

Gothic Panda Chinese Nation-State

Wizard Spider Russian Cybercrime

APT29 Russian Nation-State

APT28 Russian Nation-State

Turla Russian Nation-State

UNC4210 Russian Nation-State

Carbanak Cybercrime

FIN7 Cybercrime

TA551 Cybercrime

APT10 Chinese Nation-State

APT32 Nation-State

Code of Conduct Threat Group

Evil Corp Russian Cybercrime

Ghost Stadium Threat Group

GOLD SOUTHFIELD Russian Cybercrime

Hive0163 Threat Group

RevengeHotels APT Brazilian Nation-State

Scattered Spider Cybercrime

TA577 Nation-State

TeamPCP Cybercrime

UNC1549 Nation-State

Top MITRE Techniques

T1059.001 · PowerShellT1105 · Ingress Tool TransferT1566.001 · Spearphishing AttachmentT1027 · Obfuscated Files or Informati…T1190 · Exploit Public-Facing Applica…T1071 · Application Layer Protocol (C…T1036.005 · Match Legitimate Name or …T1547.001 · Boot/Logon Autostart Exec…T1078 · Valid AccountsT1204.002 · Malicious FileT1055 · Process InjectionT1071.001 · Web ProtocolsT1003 · OS Credential DumpingT1041 · Exfiltration Over C2 ChannelT1562.001 · Disable or Modify ToolsT1486 · Data Encrypted for Impact

⚡

Active growth area: Cloud forensics currently represents 11 of 209 labs. AWS CloudTrail/S3, Azure Sentinel, and Microsoft Defender for Cloud investigations are in active rotation — this number is moving.