// portfolio metrics

Lab Portfolio Stats

Wiki generated 2026-08-02  ·  439 pages  ·  auto-generated from Obsidian vault
// About this page
This is an auto-generated snapshot from my Obsidian vault. Surfaces patterns across 174 labs, 118 SOC alerts, and a 439-page wiki covering 48 malware families, 18 threat actors, and 234 MITRE techniques. Full writeups at /blue-team/labs.
174
Labs Completed
89
BTLO Labs
80
CyberDefenders
48
Malware Families
243
Lab MITRE Techs
234
Wiki TTP Pages
Platform & Difficulty
Platform Split
BTLO
89
CyberDefenders
80
Other
5
Difficulty Breakdown
Easy
96
Medium
59
Hard
19
Hard: secure shell · You're Hired! · First Week · Insider Threat · Dumpster · Fake · Supply Drop 1 · MailFall · TxDrop · Formbook · RoastToRoot · MarkShell - TA577 · Code Blue - APT29 · Recruiter - Hanoi Op · Maromafix Falldown - RansomHub · Spooler - APT28 · Phantom Pixels · Gh0stNet Intrusion · CryptLoad
Categories & Tools
Top Categories
Incident Response
62
Endpoint Forensics
34
Threat Intelligence
21
Network Forensics
16
Threat Hunting
15
Malware Analysis
11
Cloud Forensics
10
Detection Engineering
2
Most Used Tools
Wireshark
45
VirusTotal
37
CyberChef
31
Sysmon (System Monitor)
22
Splunk
19
Hashcat
16
Volatility
16
KQL (Kusto Query Language)
12
MITRE ATT&CK Coverage
Tactics by Wiki Source Count
Defense Evasion327
Execution175
Persistence163
Command & Control152
Initial Access146
Credential Access139
Discovery77
Collection47
Impact45
Lateral Movement43
Exfiltration41
Privilege Escalation27
Reconnaissance6
Resource Development2
Malware Families Investigated
Confirmed Families — 48 Total
IcedIDBanking Trojan / Loader
QBotBanking Trojan / Loader
Cobalt StrikePost-exploitation C2
EmotetBanking Trojan / Loader
AndromedaLoader
REvilRansomware / RaaS
XWormRemote Access Trojan
DanaBotBanking Trojan
LummaStealerInfo Stealer
RamnitBanking Trojan
AmadeyInfo Stealer
XMRigCryptominer
AsyncRATRemote Access Trojan
LockBitRansomware
Lynx RansomwareRansomware / RaaS
RansomHubRansomware / RaaS
AniviaCRTInfo Stealer
BeaverTailLoader
BreakWinMalware
CovenantPost-exploitation C2
CryptLoadLoader
EtherRATRemote Access Trojan
Gh0st RAT / FarfliRemote Access Trojan
HiddenTearRansomware
HyperScrapeMalware
Interlock RansomwareRansomware
InterlockRATRemote Access Trojan
InvisibleFerretInfo Stealer
JADESNOWLoader
KinsingRootkit
MatanbuchusLoader
MazeRansomware
MintLoaderLoader
MiraiBotnet
NerisBotBanking Trojan
PawsRunnerLoader
PureLogsInfo Stealer
Quasar RATRemote Access Trojan
RedLine StealerInfo Stealer
Rhadamanthys StealerInfo Stealer
SILENTBUILDERMalware
StrelaStealerInfo Stealer
TeamPCP PayloadInfo Stealer
TeslaCryptRansomware
VodkaStealerInfo Stealer
WinPwnPost-exploitation C2
WSHRATRemote Access Trojan
XLMRatRemote Access Trojan
Notable Specialty Labs
APT / Nation-State
Gothic Panda series · andromeda-bot-unc4210 · revil_gold
Cloud Forensics
awsraid · azurehunt · rogueazure · spilledbucket
Supply Chain
3cxsupplychain · npm_supply_chain_attack
Memory Forensics
amadey · latent · firstweek · volatilitytraces
Ransomware IR
raasunfold · revil_gold · maranhao · ramnit
Unique Scenarios
containerbreak (escape) · androidbreach (mobile)
LetsDefend — SOC Alert Triage
118
Alerts Investigated
86.4%
True Positive Rate
16
Critical Severity
33
CVEs Investigated
95
MITRE Techniques
Alert Categories
Phishing / Social Eng.
25
Brute Force / Auth
16
Malware Execution
16
Web App / CVE Abuse
15
LOLBin / Binary Abuse
8
C2 / RAT / Backdoor
8
Data Exfiltration
6
Persistence
4
Ransomware
3
Privilege Escalation
2
Network Threats
1
Severity Split
Critical
16
High
45
Medium
55
Low
2
Outcome
True Positive
102
False Positive
16
CVEs Investigated — 33 Total
CVE-2024-3400 · Palo Alto PAN-OS GlobalProtect Comm… 10.0 Critical
CVE-2021-1675 · 1675 / CVE-2021-34527 — PrintNightm… N/A
CVE-2024-35250 · Windows Kernel-Mode Driver Elevati… N/A
CVE-2025-29927 · Next.js Middleware Authorization B… 9.1 CRITICAL
CVE-2018-13379 · Fortinet FortiOS SSL VPN Path Trav… 9.8 Critical
CVE-2020-1472 · ZeroLogon (Netlogon Privilege Escal… 10.0 Critical
CVE-2021-22986 · F5 BIG-IP iControl REST Unauthenti… 9.8 Critical
CVE-2021-3156 · Sudo Baron Samedit (Heap Buffer Ove… 7.8 HIGH
CVE-2021-44228 · Log4Shell (Apache Log4j2 JNDI RCE) 10.0 Critical
CVE-2022-30190 · Follina (MSDT Remote Code Executio… 7.8 HIGH
CVE-2022-41082 · Microsoft Exchange Server RCE (Pro… 8.8 High
CVE-2023-22515 · Atlassian Confluence Broken Access… 10.0 Critical
CVE-2023-32315 · Openfire Path Traversal (Authentic… 7.5 HIGH
CVE-2023-3824 · PHP Stack Buffer Overflow (RCE) 9.8 Critical
CVE-2023-46604 · Apache ActiveMQ OpenWire Deseriali… 10.0 CRITICAL
CVE-2023-4966 · Citrix Bleed (Citrix NetScaler ADC/… 9.4 Critical
CVE-2024-1086 · Linux Kernel Netfilter Use-After-Fr… 7.8 HIGH
CVE-2024-24919 · Check Point Security Gateway Arbit… 8.6 High
CVE-2024-49019 · ADCS Certificate Template Privileg… N/A
CVE-2024-7399 · Samsung MagicInfo Premium Unauthent… N/A
CVE-2024-9264 · Grafana Remote Code Execution via D… N/A
CVE-2025-21298 · Windows OLE Zero-Click Remote Code… 9.8 Critical
CVE-2025-24071 · Windows Explorer NTLM Hash Disclos… N/A
CVE-2025-24813 · Apache Tomcat Partial PUT Java Des… N/A
CVE-2025-31161 · CrushFTP Authentication Bypass N/A
CVE-2025-32463 · Local Privilege Escalation via sud… N/A
CVE-2025-52691 · SmarterMail Unauthenticated File W… N/A
CVE-2025-53770 · SharePoint ToolShell Auth Bypass +… 9.8 Critical
CVE-2025-55182 · Next.js Server Actions Prototype P… N/A
CVE-2025-61155 · GameDriverX64.sys Anti-Cheat Drive… N/A
CVE-2025-8088 · WinRAR Zero-Day Path Traversal N/A
CVE-2026-31431 · Linux Kernel AF_ALG Logic Bug ("Co… N/A
CVE-2026-41940 · cPanel/WHM Pre-Authentication CRLF… N/A
Threat Actors Tracked — 18 Total
Lazarus Group North Korean Nation-State
Gothic Panda Chinese Nation-State
Wizard Spider Russian Cybercrime
APT29 Russian Nation-State
APT28 Russian Nation-State
Turla Russian Nation-State
UNC4210 Russian Nation-State
Carbanak Cybercrime
FIN7 Cybercrime
APT10 Chinese Nation-State
Evil Corp Russian Cybercrime
GOLD SOUTHFIELD Russian Cybercrime
Hive0163 Threat Group
RevengeHotels APT Brazilian Nation-State
Scattered Spider Cybercrime
TA551 Cybercrime
TA577 Nation-State
TeamPCP Cybercrime
Top MITRE Techniques
T1059.001 · PowerShellT1566.001 · Spearphishing AttachmentT1105 · Ingress Tool TransferT1027 · Obfuscated Files or Informati…T1190 · Exploit Public-Facing Applica…T1071 · Application Layer Protocol (C…T1547.001 · Boot/Logon Autostart Exec…T1036.005 · Match Legitimate Name or …T1078 · Valid AccountsT1055 · Process InjectionT1204.002 · Malicious FileT1003 · OS Credential DumpingT1505.003 · Web ShellT1110 · Brute ForceT1562.001 · Disable or Modify ToolsT1041 · Exfiltration Over C2 Channel
⚡
Active growth area: Cloud forensics currently represents 10 of 174 labs. AWS CloudTrail/S3, Azure Sentinel, and Microsoft Defender for Cloud investigations are in active rotation — this number is moving.
Wiki generated 2026-08-02 · 439 pages · 2142 sources ATT&CK Heatmap  ·  All Writeups