// portfolio metrics

Lab Portfolio Stats

Wiki generated 2026-09-28 · 498 pages · auto-generated from Obsidian vault

// About this page
This is an auto-generated snapshot from my Obsidian vault. Surfaces patterns across 204 labs, 119 SOC alerts, and a 498-page wiki covering 57 malware families, 21 threat actors, and 259 MITRE techniques. Full writeups at /blue-team/labs.

204

Labs Completed

BTLO Labs

CyberDefenders

Malware Families

269

Lab MITRE Techs

259

Wiki TTP Pages

Platform & Difficulty

Platform Split

BTLO

CyberDefenders

Other

Difficulty Breakdown

Easy

Medium

Hard

Hard: secure shell · You're Hired! · First Week · Insider Threat · Dumpster · Fake · Supply Drop 1 · MailFall · TxDrop · Formbook · RoastToRoot · MarkShell - TA577 · Code Blue - APT29 · Recruiter - Hanoi Op · Maromafix Falldown - RansomHub · Spooler - APT28 · Phantom Pixels · Gh0stNet Intrusion · CryptLoad · Renegade · Hollow Chapter · Ancientland Breach - LockBit · Graphi · From SEO Poisoning to Custom RMM and Cobalt Strike — Incident Response (Case 2/4) · From SEO Poisoning to Custom RMM and Cobalt Strike — Detection Engineering (Case 3/4)

Categories & Tools

Top Categories

Incident Response

Endpoint Forensics

Threat Hunting

Threat Intelligence

Network Forensics

Malware Analysis

Cloud Forensics

Detection Engineering

Most Used Tools

Wireshark

VirusTotal

CyberChef

Sysmon (System Monitor)

KQL (Kusto Query Language)

Splunk

MFTECmd

Timeline Explorer

MITRE ATT&CK Coverage

Tactics by Wiki Source Count

Defense Evasion399

Execution207

Command & Control179

Persistence178

Credential Access155

Initial Access154

Discovery103

Collection67

Impact52

Lateral Movement51

Exfiltration48

Privilege Escalation31

Resource Development7

Reconnaissance6

Malware Families Investigated

Confirmed Families — 57 Total

IcedIDBanking Trojan / Loader

QBotBanking Trojan / Loader

Cobalt StrikePost-exploitation C2

EmotetBanking Trojan / Loader

AndromedaLoader

REvilRansomware / RaaS

XWormRemote Access Trojan

DanaBotBanking Trojan

LockBitRansomware

LummaStealerInfo Stealer

RamnitBanking Trojan

UrsnifBanking Trojan / Loader

AmadeyInfo Stealer

XMRigCryptominer

AsyncRATRemote Access Trojan

EtherRATRemote Access Trojan

Lynx RansomwareRansomware / RaaS

RansomHubRansomware / RaaS

AkiraRansomware / RaaS

AniviaCRTInfo Stealer

BeaverTailLoader

BreakWinMalware

clay_ClientRemote Access Trojan

CovenantPost-exploitation C2

CryptLoadLoader

EdgeSavedPasswordsDumperInfo Stealer

Gh0st RAT / FarfliRemote Access Trojan

GRAPHIMalware

HiddenTearRansomware

HyperScrapeMalware

Interlock RansomwareRansomware

InterlockRATRemote Access Trojan

InvisibleFerretInfo Stealer

JADESNOWLoader

KinsingRootkit

MatanbuchusLoader

MazeRansomware

MintLoaderLoader

MiraiBotnet

NerisBotBanking Trojan

NimbusWiperMalware

NukeSpedMalware

PawsRunnerLoader

PureLogsInfo Stealer

Quasar RATRemote Access Trojan

RedLine StealerInfo Stealer

Rhadamanthys StealerInfo Stealer

RoguePlanet / RoguePlanetV2Malware

SILENTBUILDERMalware

StrelaStealerInfo Stealer

TeamPCP PayloadInfo Stealer

TeslaCryptRansomware

VodkaStealerInfo Stealer

WinPwnPost-exploitation C2

WSHRATRemote Access Trojan

XLMRatRemote Access Trojan

ZoomSetupCoreLoader

Notable Specialty Labs

APT / Nation-State

Gothic Panda series · andromeda-bot-unc4210 · revil_gold

Cloud Forensics

awsraid · azurehunt · rogueazure · spilledbucket

Supply Chain

3cxsupplychain · npm_supply_chain_attack

Memory Forensics

amadey · latent · firstweek · volatilitytraces

Ransomware IR

raasunfold · revil_gold · maranhao · ramnit

Unique Scenarios

containerbreak (escape) · androidbreach (mobile)

LetsDefend — SOC Alert Triage

119

Alerts Investigated

86.6%

True Positive Rate

Critical Severity

CVEs Investigated

MITRE Techniques

Alert Categories

Phishing / Social Eng.

Brute Force / Auth

Malware Execution

Web App / CVE Abuse

LOLBin / Binary Abuse

C2 / RAT / Backdoor

Data Exfiltration

Ransomware

Persistence

Privilege Escalation

Network Threats

Severity Split

Critical

High

Medium

Low

Outcome

True Positive

103

False Positive

CVEs Investigated — 35 Total

CVE-2024-3400 · Palo Alto PAN-OS GlobalProtect Comm… 10.0 Critical

CVE-2021-1675 · 1675 / CVE-2021-34527 — PrintNightm… N/A

CVE-2023-46604 · Apache ActiveMQ OpenWire Deseriali… 10.0 CRITICAL

CVE-2024-35250 · Windows Kernel-Mode Driver Elevati… N/A

CVE-2025-29927 · Next.js Middleware Authorization B… 9.1 CRITICAL

CVE-2018-13379 · Fortinet FortiOS SSL VPN Path Trav… 9.8 Critical

CVE-2020-1472 · ZeroLogon (Netlogon Privilege Escal… 10.0 Critical

CVE-2021-22986 · F5 BIG-IP iControl REST Unauthenti… 9.8 Critical

CVE-2021-3156 · Sudo Baron Samedit (Heap Buffer Ove… 7.8 HIGH

CVE-2021-44228 · Log4Shell (Apache Log4j2 JNDI RCE) 10.0 Critical

CVE-2022-30190 · Follina (MSDT Remote Code Executio… 7.8 HIGH

CVE-2022-41082 · Microsoft Exchange Server RCE (Pro… 8.8 High

CVE-2023-22515 · Atlassian Confluence Broken Access… 10.0 Critical

CVE-2023-32315 · Openfire Path Traversal (Authentic… 7.5 HIGH

CVE-2023-3824 · PHP Stack Buffer Overflow (RCE) 9.8 Critical

CVE-2023-4966 · Citrix Bleed (Citrix NetScaler ADC/… 9.4 Critical

CVE-2024-1086 · Linux Kernel Netfilter Use-After-Fr… 7.8 HIGH

CVE-2024-24919 · Check Point Security Gateway Arbit… 8.6 High

CVE-2024-49019 · ADCS Certificate Template Privileg… N/A

CVE-2024-7399 · Samsung MagicInfo Premium Unauthent… N/A

CVE-2024-9264 · Grafana Remote Code Execution via D… N/A

CVE-2025-21298 · Windows OLE Zero-Click Remote Code… 9.8 Critical

CVE-2025-24071 · Windows Explorer NTLM Hash Disclos… N/A

CVE-2025-24813 · Apache Tomcat Partial PUT Java Des… N/A

CVE-2025-31161 · CrushFTP Authentication Bypass N/A

CVE-2025-32463 · Local Privilege Escalation via sud… N/A

CVE-2025-52691 · SmarterMail Unauthenticated File W… N/A

CVE-2025-53770 · SharePoint ToolShell Auth Bypass +… 9.8 Critical

CVE-2025-55182 · Next.js Server Actions Prototype P… N/A

CVE-2025-61155 · GameDriverX64.sys Anti-Cheat Drive… N/A

CVE-2025-69691 · pfSense XMLRPC Authenticated RCE N/A

CVE-2025-8088 · WinRAR Zero-Day Path Traversal N/A

CVE-2026-31431 · Linux Kernel AF_ALG Logic Bug ("Co… N/A

CVE-2026-41940 · cPanel/WHM Pre-Authentication CRLF… N/A

CVE-2026-42980 · Windows WMI Kernel Integer Underfl… N/A

Threat Actors Tracked — 21 Total

Lazarus Group North Korean Nation-State

Gothic Panda Chinese Nation-State

Wizard Spider Russian Cybercrime

APT29 Russian Nation-State

APT28 Russian Nation-State

Turla Russian Nation-State

UNC4210 Russian Nation-State

Carbanak Cybercrime

FIN7 Cybercrime

APT10 Chinese Nation-State

Code of Conduct Threat Group

Evil Corp Russian Cybercrime

Ghost Stadium Threat Group

GOLD SOUTHFIELD Russian Cybercrime

Hive0163 Threat Group

RevengeHotels APT Brazilian Nation-State

Scattered Spider Cybercrime

TA551 Cybercrime

TA577 Nation-State

TeamPCP Cybercrime

UNC1549 Nation-State

Top MITRE Techniques

T1059.001 · PowerShellT1566.001 · Spearphishing AttachmentT1105 · Ingress Tool TransferT1027 · Obfuscated Files or Informati…T1190 · Exploit Public-Facing Applica…T1036.005 · Match Legitimate Name or …T1071 · Application Layer Protocol (C…T1547.001 · Boot/Logon Autostart Exec…T1078 · Valid AccountsT1204.002 · Malicious FileT1055 · Process InjectionT1071.001 · Web ProtocolsT1003 · OS Credential DumpingT1562.001 · Disable or Modify ToolsT1041 · Exfiltration Over C2 ChannelT1486 · Data Encrypted for Impact

⚡

Active growth area: Cloud forensics currently represents 11 of 204 labs. AWS CloudTrail/S3, Azure Sentinel, and Microsoft Defender for Cloud investigations are in active rotation — this number is moving.