Threat hunt investigations, raw logs, lessons, and a few dead ends along the way.
- Writeups: Step-by-step investigations, findings, and walkthroughs for each public CTF or incident I participate in.
- KQL Logs: Raw query experiments, pivots, and iterations—so you see what worked and what didn’t.
- Templates: My personal templates for keeping writeups and notes consistent (and hopefully useful).
- To document the real process—failed hunts, “aha!” moments, and learning pivots.
- To help fellow learners (and my future self) find practical blue team references.
- To make investigations more repeatable (and less mysterious).
| 🏴☠️ CTF/Lab | 📝 Description | 📄 Writeup | 📊 KQL Logs | 🗒️ Notes (PDF) |
|---|---|---|---|---|
| Deep Access: The Adversary | Multi-host CTF; persistence, lateral movement | Coming soon | Sorry I lost it | Deep Access The Adversary.pdf |
| The Great Admin Heist | Malware dropper, LOLBin, persistence hunt | Coming soon | KQL Logs | The Great Admin Heist.pdf |
| More coming soon... |
Victor Cardoso (aka Shoganaich)
Cybersecurity student & intern • Learning by doing
GitHub | LinkedIn | Blog
This repo and all its contents are released under the MIT License — feel free to learn, fork, and remix (at your own risk!).
🦖 Don’t ask.