Whoami
  • Welcome
  • Home Lab: C2 Detection, Ransomware Defense & YARA Automation
    • SOC Lab – What is this Lab about ?
    • Part 1 - Setting Up the Environment
    • Part 2 - Detecting C2 Activity
    • Part 3 - Credential Dumping & Threat Detection
    • Part 4 - Blocking Ransomware
    • Part 5 - Reducing False Positives
    • Part 6 - Automated YARA Scanning
  • Automation Lab - Home Project
    • Sysmon Installation
    • Wazuh & TheHive: Installation, Configuration, and Optimization
    • Tracking Mimikatz Activity with Wazuh & Sysmon Logs
    • End-to-End Alert Automation: Wazuh → Shuffle → TheHive
  • Active Directory Attack Lab: Recon-to-Root
    • Reconnaissance Phase
      • 1. Full TCP Port Scan on Target Host
      • 2. Service and Version Detection
      • 3. Null Session SMB Enumeration
      • 4. LDAP Anonymous Bind Check
      • 5. Kerberos Username Enumeration
      • 6. Password Brute Force via SMB Login
    • Exploitation Phase
      • 7. Dump Domain Information via LDAP
      • 8. Perform Remote AD Recon with BloodHound
      • 9. Set Up Neo4j and Launch BloodHound GUI
      • 10. Abuse ForceChangePassword Right via RPC
      • 11. Validate New Credentials via WinRM
      • 12. Enumerate Local Privileges and AutoLogon
      • 13. Reuse Administrator Credentials
      • 14. Capture the User Flag
  • QRadar101 Lab Challenge
    • Scenario and Instructions
    • The Walkthrough
Powered by GitBook
On this page

QRadar101 Lab Challenge

Hands-on Analysis & Investigation Guide

Previous14. Capture the User FlagNextScenario and Instructions

Last updated 11 days ago

Objectives of the QRadar101 Lab Challenge

  • ✅ Get familiar with IBM QRadar as a SIEM tool.

  • 🔍 Practice filtering and analyzing logs to track attacker activity.

  • 🕵️‍♂️ Investigate a real attack scenario using QRadar's event logs and offenses.

  • 🧠 Improve skills in log correlation, event investigation, and IOC identification.

  • 💡 Learn how to extract useful insights and link logs to specific hosts, users, and malicious actions.

  • 📁 Build a clear timeline of the attack using available artifacts (e.g., process creation logs, Suricata alerts, HTTP payloads).

Based on CyberDefenders Blue Team CTF

https://cyberdefenders.org/blueteam-ctf-challenges/qradar101/