Our Labs

Choose between our Basic and Premium labs. All labs are designed by people with real life cloud incident response experience.

Basic Labs

Perfect for beginners or curious explorers

  • Azure: Investigation of a suspicious automation account
  • Microsoft 365: Silent Forwarding: Detecting Malicious Mailbox Rules
  • AWS: Operation Phishing Hook

Premium Labs

Level up your cloud incident response skills with premium labs

  • Defender: Adversary-in-the-Middle, Detection via Known IOCs
  • Sentinel: Cryptojacking via RunCommand
  • AWS: Static Site Hijack & AWS Backdoor
  • Plus many more!

All-In Labs

Master complex cloud security scenarios with our advanced labs

  • Multi-cloud Investigations
    Learn to investigate security incidents across multiple cloud providers simultaneously, including correlation and analysis.
  • Advanced Threat Hunting
    Develop advanced threat hunting skills using cloud-native tools and techniques across major cloud platforms.
  • Custom Lab Development
    Create and deploy custom security labs tailored to your organization's specific cloud environment and needs.

Bucket Reaper

Category Premium Platform AWS Difficulty Medium

In this lab you will investigate a ransomware that was discoverd, because a very important S3 bucket contained only one file...a ransomnote.txt

Cloud Whisperer

Category Premium Platform AWS Difficulty Medium

A developer reported unusual outbound DNS traffic from a private subnet. An EC2 instance makes an HTTP request to a known cryptomining C2 domain. Time to investigate!

Operation Phishing Hook

Category Premium Platform AWS Difficulty Medium

Your Security Operations Center has flagged unusual email activity from your AWS account. Amazon SES is showing thousands of outbound emails and employees are reporting receiving "company communications" they didn't expect.

Foothold via OAuth

Category Premium Platform Entra ID Difficulty Easy

You've probably heard of OAuth applications and service principals. You're not the only one, threat actors love them too. Can you find the malicious app?

Suspicious Automation Account

Category Free Platform Azure Difficulty Easy

Automation accounts are great for automating things. For instance, data exfiltration!

Cryptojacking via RunCommand

Category Premium Platform Sentinel Difficulty Hard

Function apps are a great persistence method in the cloud, but have you ever investigated their code, execution history and how they ended up there?

Adversary-in-the-Middle

Category Premium Platform Microsoft Defender Difficulty Hard

Scattered Spider has been very active and you've just identified an alert in Sentinel for an Indicator Of Compromise (IOC) related to this group. It's your task to investigate what actions were performed, can you do it?

Silent Forwarding

Category Free Platform Microsoft 365 Difficulty Easy

Threat actors often exploit mailbox rules to silently manipulate email flow, hiding legitimate messages, or forwarding sensitive content externally. You'll act as a security analyst investigating suspicious mailbox rule activity within a Microsoft 365 environment.

Storm Catcher

Category Free Platform Microsoft 365 Difficulty Hard

This isn’t just mailbox rules, it’s a full-blown BEC. A DLP sweep flags mass deletions and odd forwarding in the Finance department, but users deny it, and intel points to the BEC actor known as Storm-1167. You’ll investigate a multi-stage intrusion with persistence, alert suppression, and Graph API abuse.

KQL Basics: Hands-On

Category Premium Platform Azure Difficulty Easy

Learn essential KQL fundamentals through hands-on challenges using Entra ID logs. Start from the basics, build queries, filter data, parse JSON structures, and aggregate results. Perfect for beginners to get familiar with Azure's query language.

Open Port, Open Door

Category Premium Platform Azure Difficulty Medium

This isn’t just mailbox rules, it’s a full-blown BEC. A DLP sweep flags mass deletions and odd forwarding in the Finance department, but users deny it, and intel points to the BEC actor known as Storm-1167. You’ll investigate a multi-stage intrusion with persistence, alert suppression, and Graph API abuse.

Threat Actor-led Scenarios

These scenario labs simulate real-world campaigns by known threat actors so you can practice end-to-end investigation and response in a safe environment.

TraderTraitor

Simulates a social-engineering and developer tooling compromise leading to cloud credential abuse and crypto theft in a hybrid environment.

  • Multi-cloud investigation
  • Cloud credential triage
  • Incident documentation

Sea Turtle

Simulates DNS tampering and credential interception to pivot into cloud resources and disrupt critical services.

  • DNS and identity telemetry
  • Containment and hardening
  • Stakeholder communication

Laundry Bear

Simulates OAuth consent phishing and mailbox rule abuse to launder access and exfiltrate sensitive data from cloud accounts.

  • User behavior analytics
  • Access pattern analysis
  • Evidence collection