Aliens CTF — DFIR: 7 Oct

ahmad.massad.ir@gmail.com (Ahmad Massad) — Wed, 20 Aug 2025 00:00:00 +0000

Challenge: 7 Oct
#

Description
#

We stormed one of the enemy’s concentration areas and after completing the operation, we took some devices to investigate and obtain intelligence. One device belongs to a leader. We believe information is being leaked through a spy. Search the device to find the spy and location details — the enemy was planning a prisoner recovery operation and location information had been leaked to them.

Cyber Warriors CTF — Forensics: Investigation Nashmi APT

ahmad.massad.ir@gmail.com (Ahmad Massad) — Sat, 16 Aug 2025 00:00:00 +0000

Introduction
#

Our Security Operations Center (SOC) detected suspicious activity originating from an internal employee workstation. The employee — a finance team member — reported slow system performance and unexpected behavior. Shortly after, EDR logs showed signs of malware persistence and suspicious outbound traffic.

Mission: Analyze a full memory image of the compromised machine, identify the scope of the infection, and answer key investigation questions.

Write-ups on Ahmad Massd — Security Blog

Aliens CTF — DFIR: 7 Oct

Challenge: 7 Oct #

Description #

Cyber Warriors CTF — Forensics: Investigation Nashmi APT

Introduction #

Challenge: 7 Oct
#

Description
#

Introduction
#