https://welbournesecurity.com/ Practical blue-team learning, investigation scenarios, and CTF writeups. en-gb Fri, 31 Jul 2026 00:00:00 GMT https://welbournesecurity.com/writeups/htb/cyber-apocalypse-2026/aiml/mement0/ https://welbournesecurity.com/writeups/htb/cyber-apocalypse-2026/aiml/mement0/#Writeup: Mement0 Fri, 31 Jul 2026 00:00:00 GMT An offline AI/ML challenge where a scraping agent's CLAUDE.md standing memory and .claude skills are turned against it to recover a rite deleted from the record but kept in the repo's older history. https://welbournesecurity.com/writeups/htb/cyber-apocalypse-2026/hardware/saltlock-drift/ https://welbournesecurity.com/writeups/htb/cyber-apocalypse-2026/hardware/saltlock-drift/#Writeup: Saltlock Drift Fri, 31 Jul 2026 00:00:00 GMT A RollJam-style RF replay on a GateCar RF-433 fob: jam the receiver, sniff two presses, then replay an unused rolling code to unlock and reveal the token. https://welbournesecurity.com/writeups/htb/cyber-apocalypse-2026/hardware/what-the-shard-displayed/ https://welbournesecurity.com/writeups/htb/cyber-apocalypse-2026/hardware/what-the-shard-displayed/#Writeup: What the Shard Displayed Fri, 31 Jul 2026 00:00:00 GMT Reconstruct a sigrok/PulseView logic-analyzer capture of an embedded display device to recover the image it painted, and the token drawn with it. https://welbournesecurity.com/writeups/htb/cyber-apocalypse-2026/ics/ash-vault-interlock/ https://welbournesecurity.com/writeups/htb/cyber-apocalypse-2026/ics/ash-vault-interlock/#Writeup: Ash-Vault Interlock Fri, 31 Jul 2026 00:00:00 GMT Drive a Modbus/TCP interlock PLC and its HMI to halt an unstable cycle, force the seal-ready state, and release the checkpoint token from the alarm table. https://welbournesecurity.com/writeups/htb/cyber-apocalypse-2026/ics/crownspire-transfer/ https://welbournesecurity.com/writeups/htb/cyber-apocalypse-2026/ics/crownspire-transfer/#Writeup: Crownspire Transfer Fri, 31 Jul 2026 00:00:00 GMT Use an IEC 60870-5-104 RTU and a captured maintenance session to force an interlocked power transfer and collect the feeder-trip checkpoint token. https://welbournesecurity.com/writeups/htb/cyber-apocalypse-2026/ics/line-tap/ https://welbournesecurity.com/writeups/htb/cyber-apocalypse-2026/ics/line-tap/#Writeup: Line Tap Fri, 31 Jul 2026 00:00:00 GMT A forgotten RiverGate PLC still answers over telnet; sign in on old maintenance habits and read back the latest checkpoint token. https://welbournesecurity.com/blue-team/case-studies/stuxnet/ https://welbournesecurity.com/blue-team/case-studies/stuxnet/#Case Study: Stuxnet Sun, 26 Jul 2026 00:00:00 GMT The first malware known to cause physical destruction, using multiple zero-days and stolen certificates to cross an air gap and sabotage Iranian nuclear centrifuges while reporting normal readings to operators. https://welbournesecurity.com/blue-team/case-studies/target/ https://welbournesecurity.com/blue-team/case-studies/target/#Case Study: Target 2013 Sun, 26 Jul 2026 00:00:00 GMT Attackers phished an HVAC contractor, used its vendor-portal access to reach Target's flat internal network, and scraped 40 million card numbers from point-of-sale memory. https://welbournesecurity.com/blue-team/case-studies/equifax/ https://welbournesecurity.com/blue-team/case-studies/equifax/#Case Study: Equifax Sun, 26 Jul 2026 00:00:00 GMT Attackers exploited an unpatched Apache Struts flaw in a public web portal, found plaintext credentials, and quietly queried dozens of databases for months, stealing the personal data of about 147 million people. https://welbournesecurity.com/blue-team/case-studies/notpetya/ https://welbournesecurity.com/blue-team/case-studies/notpetya/#Case Study: NotPetya Sun, 26 Jul 2026 00:00:00 GMT A destructive wiper disguised as ransomware that spread through a trojanised accounting-software update, then used a stolen NSA exploit and credential theft to cross flat networks in minutes. https://welbournesecurity.com/blue-team/case-studies/wannacry/ https://welbournesecurity.com/blue-team/case-studies/wannacry/#Case Study: WannaCry Sun, 26 Jul 2026 00:00:00 GMT A ransomware worm that used the leaked EternalBlue SMB exploit to infect over 200,000 unpatched Windows systems in days, until an accidental kill-switch domain slowed it down. https://welbournesecurity.com/blue-team/case-studies/capital-one/ https://welbournesecurity.com/blue-team/case-studies/capital-one/#Case Study: Capital One Sun, 26 Jul 2026 00:00:00 GMT A misconfigured web application firewall let an attacker trick a cloud server into handing over its own IAM credentials, which were then used to copy more than 100 million customer records out of AWS S3. https://welbournesecurity.com/blue-team/case-studies/sunburst/ https://welbournesecurity.com/blue-team/case-studies/sunburst/#Case Study: SolarWinds SUNBURST Sun, 26 Jul 2026 00:00:00 GMT A stealthy supply-chain compromise that inserted a backdoor into signed SolarWinds Orion updates, then used DNS beaconing and forged SAML tokens to move quietly into cloud environments over months. https://welbournesecurity.com/blue-team/case-studies/colonial-pipeline/ https://welbournesecurity.com/blue-team/case-studies/colonial-pipeline/#Case Study: Colonial Pipeline Sun, 26 Jul 2026 00:00:00 GMT A single leaked VPN password with no multi-factor authentication let DarkSide ransomware into Colonial's IT network, and the precautionary shutdown that followed cut fuel to much of the US East Coast. https://welbournesecurity.com/blue-team/case-studies/kaseya/ https://welbournesecurity.com/blue-team/case-studies/kaseya/#Case Study: Kaseya VSA / REvil Sun, 26 Jul 2026 00:00:00 GMT Attackers exploited zero-days in Kaseya's remote-management software and used its own trusted update channel to push REvil ransomware through managed service providers to roughly 1,500 downstream businesses at once. https://welbournesecurity.com/blue-team/case-studies/log4shell/ https://welbournesecurity.com/blue-team/case-studies/log4shell/#Case Study: Log4Shell Sun, 26 Jul 2026 00:00:00 GMT A trivially exploitable remote-code-execution flaw in the ubiquitous Log4j logging library, where a single attacker-controlled string in any log message could make a server fetch and run malicious code. https://welbournesecurity.com/blue-team/case-studies/uber/ https://welbournesecurity.com/blue-team/case-studies/uber/#Case Study: Uber 2022 Sun, 26 Jul 2026 00:00:00 GMT An attacker bought a contractor's password, wore down their multi-factor authentication with repeated push prompts and a fake IT message, then found hardcoded admin credentials in a script that unlocked Uber's internal systems. https://welbournesecurity.com/blue-team/case-studies/moveit/ https://welbournesecurity.com/blue-team/case-studies/moveit/#Case Study: MOVEit / Cl0p Sun, 26 Jul 2026 00:00:00 GMT A SQL-injection zero-day in the widely used MOVEit Transfer file-sharing product let the Cl0p group deploy a web shell and steal data from hundreds of organisations in a single mass-extortion campaign. https://welbournesecurity.com/blue-team/case-studies/iocontrol/ https://welbournesecurity.com/blue-team/case-studies/iocontrol/#Case Study: IOCONTROL Sun, 26 Jul 2026 00:00:00 GMT A modular, Linux-based backdoor built to compromise internet-exposed IoT and OT devices, used by an Iran-linked group to reach fuel-management systems over an MQTT command channel. https://welbournesecurity.com/blue-team/learn/services/active-directory-certificate-services/ https://welbournesecurity.com/blue-team/learn/services/active-directory-certificate-services/#Learn: Active Directory Certificate Services Wed, 15 Jul 2026 00:00:00 GMT Active Directory Certificate Services issues and manages certificates used for user, device and service authentication inside a Windows public key infrastructure. https://welbournesecurity.com/blue-team/learn/services/active-directory-federation-services/ https://welbournesecurity.com/blue-team/learn/services/active-directory-federation-services/#Learn: Active Directory Federation Services Wed, 15 Jul 2026 00:00:00 GMT Active Directory Federation Services acts as a security token service for federated sign-in and claims-based application access. https://welbournesecurity.com/blue-team/learn/services/active-directory-web-services/ https://welbournesecurity.com/blue-team/learn/services/active-directory-web-services/#Learn: Active Directory Web Services Wed, 15 Jul 2026 00:00:00 GMT Active Directory Web Services exposes Active Directory management functions to modern administrative tools. https://welbournesecurity.com/blue-team/learn/services/amqp-rabbitmq/ https://welbournesecurity.com/blue-team/learn/services/amqp-rabbitmq/#Learn: AMQP/RabbitMQ Wed, 15 Jul 2026 00:00:00 GMT AMQP/RabbitMQ moves queued messages between producers, brokers and consumers. https://welbournesecurity.com/blue-team/learn/services/apache-cassandra/ https://welbournesecurity.com/blue-team/learn/services/apache-cassandra/#Learn: Apache Cassandra Wed, 15 Jul 2026 00:00:00 GMT Apache Cassandra provides a distributed wide-column database designed for resilient multi-node storage. https://welbournesecurity.com/blue-team/learn/services/apache-kafka/ https://welbournesecurity.com/blue-team/learn/services/apache-kafka/#Learn: Apache Kafka Wed, 15 Jul 2026 00:00:00 GMT Apache Kafka moves durable event streams between producers, brokers and consumers. https://welbournesecurity.com/blue-team/learn/services/apache-zookeeper/ https://welbournesecurity.com/blue-team/learn/services/apache-zookeeper/#Learn: Apache ZooKeeper Wed, 15 Jul 2026 00:00:00 GMT Apache ZooKeeper coordinates distributed applications through shared configuration, naming and leader election. https://welbournesecurity.com/blue-team/learn/services/aws-ec2-instance-metadata-service/ https://welbournesecurity.com/blue-team/learn/services/aws-ec2-instance-metadata-service/#Learn: AWS EC2 Instance Metadata Service Wed, 15 Jul 2026 00:00:00 GMT AWS EC2 Instance Metadata Service provides an EC2 workload with instance metadata, user data and temporary role credentials through a link-local endpoint. https://welbournesecurity.com/blue-team/learn/services/azure-instance-metadata-service/ https://welbournesecurity.com/blue-team/learn/services/azure-instance-metadata-service/#Learn: Azure Instance Metadata Service Wed, 15 Jul 2026 00:00:00 GMT Azure Instance Metadata Service provides Azure virtual machines with instance metadata and managed-identity token access through a link-local endpoint. https://welbournesecurity.com/blue-team/learn/services/bacnet-ip/ https://welbournesecurity.com/blue-team/learn/services/bacnet-ip/#Learn: BACnet/IP Wed, 15 Jul 2026 00:00:00 GMT BACnet/IP connects building automation controllers, sensors and management systems. https://welbournesecurity.com/blue-team/learn/services/bgp/ https://welbournesecurity.com/blue-team/learn/services/bgp/#Learn: BGP Wed, 15 Jul 2026 00:00:00 GMT BGP exchanges reachable network prefixes and path attributes between routing domains. https://welbournesecurity.com/blue-team/learn/services/consul/ https://welbournesecurity.com/blue-team/learn/services/consul/#Learn: Consul Wed, 15 Jul 2026 00:00:00 GMT Consul provides service discovery, health information, key-value data and service-mesh control functions. https://welbournesecurity.com/blue-team/learn/services/containerd-and-cri/ https://welbournesecurity.com/blue-team/learn/services/containerd-and-cri/#Learn: containerd and the Container Runtime Interface Wed, 15 Jul 2026 00:00:00 GMT containerd and the Container Runtime Interface manages container images, snapshots and runtime tasks for higher-level orchestrators such as Kubernetes. https://welbournesecurity.com/blue-team/learn/services/dhcp/ https://welbournesecurity.com/blue-team/learn/services/dhcp/#Learn: DHCP Wed, 15 Jul 2026 00:00:00 GMT DHCP leases addressing, gateway and name-service configuration to clients. https://welbournesecurity.com/blue-team/learn/services/dnp3/ https://welbournesecurity.com/blue-team/learn/services/dnp3/#Learn: DNP3 Wed, 15 Jul 2026 00:00:00 GMT DNP3 carries telemetry and control messages in utility and industrial environments. https://welbournesecurity.com/blue-team/learn/services/dns/ https://welbournesecurity.com/blue-team/learn/services/dns/#Learn: DNS Wed, 15 Jul 2026 00:00:00 GMT DNS resolves names to records and helps clients locate systems and services. https://welbournesecurity.com/blue-team/learn/services/docker-engine-api/ https://welbournesecurity.com/blue-team/learn/services/docker-engine-api/#Learn: Docker Engine API Wed, 15 Jul 2026 00:00:00 GMT Docker Engine API controls Docker hosts, containers, images and volumes through an HTTP API. https://welbournesecurity.com/blue-team/learn/services/docker-registry/ https://welbournesecurity.com/blue-team/learn/services/docker-registry/#Learn: Docker Registry Wed, 15 Jul 2026 00:00:00 GMT Docker Registry stores and distributes container image manifests and layers. https://welbournesecurity.com/blue-team/learn/services/docker-swarm/ https://welbournesecurity.com/blue-team/learn/services/docker-swarm/#Learn: Docker Swarm Wed, 15 Jul 2026 00:00:00 GMT Docker Swarm coordinates Docker nodes, services and overlay networks as a clustered orchestration platform. https://welbournesecurity.com/blue-team/learn/services/elasticsearch/ https://welbournesecurity.com/blue-team/learn/services/elasticsearch/#Learn: Elasticsearch Wed, 15 Jul 2026 00:00:00 GMT Elasticsearch provides search APIs and cluster transport for indexed data. https://welbournesecurity.com/blue-team/learn/services/encrypted-dns/ https://welbournesecurity.com/blue-team/learn/services/encrypted-dns/#Learn: Encrypted DNS Wed, 15 Jul 2026 00:00:00 GMT Encrypted DNS protects DNS queries using DNS over HTTPS, DNS over TLS or related encrypted transports. https://welbournesecurity.com/blue-team/learn/services/etcd/ https://welbournesecurity.com/blue-team/learn/services/etcd/#Learn: etcd Wed, 15 Jul 2026 00:00:00 GMT etcd stores Kubernetes and distributed-system state as a consistent key-value database. https://welbournesecurity.com/blue-team/learn/services/ethernet-ip/ https://welbournesecurity.com/blue-team/learn/services/ethernet-ip/#Learn: EtherNet/IP Wed, 15 Jul 2026 00:00:00 GMT EtherNet/IP carries Common Industrial Protocol messaging for controllers, I/O and engineering systems. https://welbournesecurity.com/blue-team/learn/services/ftp/ https://welbournesecurity.com/blue-team/learn/services/ftp/#Learn: FTP Wed, 15 Jul 2026 00:00:00 GMT FTP transfers files using separate control and data connections. https://welbournesecurity.com/blue-team/learn/services/ftps/ https://welbournesecurity.com/blue-team/learn/services/ftps/#Learn: FTPS Wed, 15 Jul 2026 00:00:00 GMT FTPS adds TLS protection to FTP control and data channels. https://welbournesecurity.com/blue-team/learn/services/git-protocol/ https://welbournesecurity.com/blue-team/learn/services/git-protocol/#Learn: Git protocol Wed, 15 Jul 2026 00:00:00 GMT Git protocol serves Git repositories using the native unauthenticated transport. https://welbournesecurity.com/blue-team/learn/services/global-catalog/ https://welbournesecurity.com/blue-team/learn/services/global-catalog/#Learn: Global Catalog Wed, 15 Jul 2026 00:00:00 GMT Global Catalog answers forest-wide Active Directory searches using a partial attribute set. https://welbournesecurity.com/blue-team/learn/services/google-cloud-metadata-server/ https://welbournesecurity.com/blue-team/learn/services/google-cloud-metadata-server/#Learn: Google Cloud metadata server Wed, 15 Jul 2026 00:00:00 GMT Google Cloud metadata server provides Compute Engine workloads with instance data and service-account access tokens. https://welbournesecurity.com/blue-team/learn/services/hashicorp-vault/ https://welbournesecurity.com/blue-team/learn/services/hashicorp-vault/#Learn: HashiCorp Vault Wed, 15 Jul 2026 00:00:00 GMT HashiCorp Vault brokers secrets, encryption operations and short-lived credentials under centrally managed policy. https://welbournesecurity.com/blue-team/learn/services/http-proxy/ https://welbournesecurity.com/blue-team/learn/services/http-proxy/#Learn: HTTP proxy Wed, 15 Jul 2026 00:00:00 GMT HTTP proxy relays web requests for filtering, caching, inspection or controlled egress. https://welbournesecurity.com/blue-team/learn/services/http/ https://welbournesecurity.com/blue-team/learn/services/http/#Learn: HTTP Wed, 15 Jul 2026 00:00:00 GMT HTTP carries web requests, API calls and application responses. https://welbournesecurity.com/blue-team/learn/services/https-tls/ https://welbournesecurity.com/blue-team/learn/services/https-tls/#Learn: HTTPS/TLS Wed, 15 Jul 2026 00:00:00 GMT HTTPS/TLS protects web and application traffic with TLS, commonly using HTTP over TCP or QUIC. https://welbournesecurity.com/blue-team/learn/services/iec-60870-5-104/ https://welbournesecurity.com/blue-team/learn/services/iec-60870-5-104/#Learn: IEC 60870-5-104 Wed, 15 Jul 2026 00:00:00 GMT IEC 60870-5-104 carries telecontrol messages between control centres and substations over IP. https://welbournesecurity.com/blue-team/learn/services/ike-ipsec/ https://welbournesecurity.com/blue-team/learn/services/ike-ipsec/#Learn: IKE/IPsec Wed, 15 Jul 2026 00:00:00 GMT IKE/IPsec negotiates keys and protects IP traffic with authenticated tunnels. https://welbournesecurity.com/blue-team/learn/services/imap/ https://welbournesecurity.com/blue-team/learn/services/imap/#Learn: IMAP Wed, 15 Jul 2026 00:00:00 GMT IMAP synchronises mailbox folders and messages between clients and servers. https://welbournesecurity.com/blue-team/learn/services/ipmi-rmcp/ https://welbournesecurity.com/blue-team/learn/services/ipmi-rmcp/#Learn: IPMI and RMCP Wed, 15 Jul 2026 00:00:00 GMT IPMI and RMCP provides out-of-band hardware monitoring and management through a baseboard management controller. https://welbournesecurity.com/blue-team/learn/services/iscsi/ https://welbournesecurity.com/blue-team/learn/services/iscsi/#Learn: iSCSI Wed, 15 Jul 2026 00:00:00 GMT iSCSI carries block-storage commands across IP networks. https://welbournesecurity.com/blue-team/learn/services/kerberos/ https://welbournesecurity.com/blue-team/learn/services/kerberos/#Learn: Kerberos Wed, 15 Jul 2026 00:00:00 GMT Kerberos issues time-limited tickets for authenticated access to services. https://welbournesecurity.com/blue-team/learn/services/kubelet/ https://welbournesecurity.com/blue-team/learn/services/kubelet/#Learn: kubelet Wed, 15 Jul 2026 00:00:00 GMT kubelet manages pods and exposes node-level status and execution interfaces. https://welbournesecurity.com/blue-team/learn/services/kubernetes-api/ https://welbournesecurity.com/blue-team/learn/services/kubernetes-api/#Learn: Kubernetes API Wed, 15 Jul 2026 00:00:00 GMT Kubernetes API controls Kubernetes objects, identities and cluster state. https://welbournesecurity.com/blue-team/learn/services/ldap/ https://welbournesecurity.com/blue-team/learn/services/ldap/#Learn: LDAP Wed, 15 Jul 2026 00:00:00 GMT LDAP queries and changes directory objects such as users, groups and policies. https://welbournesecurity.com/blue-team/learn/services/llmnr/ https://welbournesecurity.com/blue-team/learn/services/llmnr/#Learn: LLMNR Wed, 15 Jul 2026 00:00:00 GMT LLMNR provides local-link name resolution when DNS does not answer. https://welbournesecurity.com/blue-team/learn/services/mdns/ https://welbournesecurity.com/blue-team/learn/services/mdns/#Learn: mDNS Wed, 15 Jul 2026 00:00:00 GMT mDNS provides multicast name discovery on a local link without a central DNS server. https://welbournesecurity.com/blue-team/learn/services/memcached/ https://welbournesecurity.com/blue-team/learn/services/memcached/#Learn: Memcached Wed, 15 Jul 2026 00:00:00 GMT Memcached holds transient application data in memory to reduce repeated database or computation work. https://welbournesecurity.com/blue-team/learn/services/microsoft-sql-server/ https://welbournesecurity.com/blue-team/learn/services/microsoft-sql-server/#Learn: Microsoft SQL Server Wed, 15 Jul 2026 00:00:00 GMT Microsoft SQL Server hosts relational databases and exposes discovery and query services. https://welbournesecurity.com/blue-team/learn/services/modbus-tcp/ https://welbournesecurity.com/blue-team/learn/services/modbus-tcp/#Learn: Modbus/TCP Wed, 15 Jul 2026 00:00:00 GMT Modbus/TCP carries simple industrial read and write operations between controllers and supervisory systems. https://welbournesecurity.com/blue-team/learn/services/mongodb/ https://welbournesecurity.com/blue-team/learn/services/mongodb/#Learn: MongoDB Wed, 15 Jul 2026 00:00:00 GMT MongoDB provides document database queries, replication and administration. https://welbournesecurity.com/blue-team/learn/services/mqtt/ https://welbournesecurity.com/blue-team/learn/services/mqtt/#Learn: MQTT Wed, 15 Jul 2026 00:00:00 GMT MQTT provides lightweight publish and subscribe messaging for devices and applications. https://welbournesecurity.com/blue-team/learn/services/mysql-mariadb/ https://welbournesecurity.com/blue-team/learn/services/mysql-mariadb/#Learn: MySQL/MariaDB Wed, 15 Jul 2026 00:00:00 GMT MySQL/MariaDB provides relational database sessions for applications and administrators. https://welbournesecurity.com/blue-team/learn/services/nats/ https://welbournesecurity.com/blue-team/learn/services/nats/#Learn: NATS Wed, 15 Jul 2026 00:00:00 GMT NATS provides lightweight publish and subscribe messaging for applications and distributed systems. https://welbournesecurity.com/blue-team/learn/services/netbios/ https://welbournesecurity.com/blue-team/learn/services/netbios/#Learn: NetBIOS Wed, 15 Jul 2026 00:00:00 GMT NetBIOS supports legacy Windows naming, datagrams and session services. https://welbournesecurity.com/blue-team/learn/services/nfs/ https://welbournesecurity.com/blue-team/learn/services/nfs/#Learn: NFS Wed, 15 Jul 2026 00:00:00 GMT NFS exports filesystems to Unix and Linux clients over the network. https://welbournesecurity.com/blue-team/learn/services/ntp/ https://welbournesecurity.com/blue-team/learn/services/ntp/#Learn: NTP Wed, 15 Jul 2026 00:00:00 GMT NTP synchronises clocks so systems and security evidence share a reliable time base. https://welbournesecurity.com/blue-team/learn/services/oauth-2-and-openid-connect/ https://welbournesecurity.com/blue-team/learn/services/oauth-2-and-openid-connect/#Learn: OAuth 2.0 and OpenID Connect Wed, 15 Jul 2026 00:00:00 GMT OAuth 2.0 and OpenID Connect delegates application access and adds an identity layer through signed tokens and provider metadata. https://welbournesecurity.com/blue-team/learn/services/opc-ua/ https://welbournesecurity.com/blue-team/learn/services/opc-ua/#Learn: OPC UA Wed, 15 Jul 2026 00:00:00 GMT OPC UA exchanges structured industrial data between clients, servers and gateways. https://welbournesecurity.com/blue-team/learn/services/openvpn/ https://welbournesecurity.com/blue-team/learn/services/openvpn/#Learn: OpenVPN Wed, 15 Jul 2026 00:00:00 GMT OpenVPN creates TLS-based remote-access or site-to-site virtual private networks. https://welbournesecurity.com/blue-team/learn/services/oracle-net/ https://welbournesecurity.com/blue-team/learn/services/oracle-net/#Learn: Oracle Net Wed, 15 Jul 2026 00:00:00 GMT Oracle Net connects Oracle database clients to listeners and database services. https://welbournesecurity.com/blue-team/learn/services/ospf/ https://welbournesecurity.com/blue-team/learn/services/ospf/#Learn: OSPF Wed, 15 Jul 2026 00:00:00 GMT OSPF shares internal routes between routers inside an autonomous system. https://welbournesecurity.com/blue-team/learn/services/pop3/ https://welbournesecurity.com/blue-team/learn/services/pop3/#Learn: POP3 Wed, 15 Jul 2026 00:00:00 GMT POP3 downloads mailbox messages to a client. https://welbournesecurity.com/blue-team/learn/services/postgresql/ https://welbournesecurity.com/blue-team/learn/services/postgresql/#Learn: PostgreSQL Wed, 15 Jul 2026 00:00:00 GMT PostgreSQL provides relational database sessions with extensible authentication and query features. https://welbournesecurity.com/blue-team/learn/services/profinet/ https://welbournesecurity.com/blue-team/learn/services/profinet/#Learn: PROFINET Wed, 15 Jul 2026 00:00:00 GMT PROFINET connects industrial controllers, engineering systems and field devices for cyclic and acyclic automation traffic. https://welbournesecurity.com/blue-team/learn/services/prometheus/ https://welbournesecurity.com/blue-team/learn/services/prometheus/#Learn: Prometheus Wed, 15 Jul 2026 00:00:00 GMT Prometheus scrapes and stores time-series metrics and provides a query API for monitoring data. https://welbournesecurity.com/blue-team/learn/services/radius/ https://welbournesecurity.com/blue-team/learn/services/radius/#Learn: RADIUS Wed, 15 Jul 2026 00:00:00 GMT RADIUS centralises network access authentication, authorisation and accounting. https://welbournesecurity.com/blue-team/learn/services/rdp/ https://welbournesecurity.com/blue-team/learn/services/rdp/#Learn: RDP Wed, 15 Jul 2026 00:00:00 GMT RDP provides interactive Windows desktop sessions and remote administration. https://welbournesecurity.com/blue-team/learn/services/redis/ https://welbournesecurity.com/blue-team/learn/services/redis/#Learn: Redis Wed, 15 Jul 2026 00:00:00 GMT Redis provides an in-memory key-value store often used for caching, queues and sessions. https://welbournesecurity.com/blue-team/learn/services/rpc-dcom-endpoint-mapper/ https://welbournesecurity.com/blue-team/learn/services/rpc-dcom-endpoint-mapper/#Learn: RPC/DCOM Endpoint Mapper Wed, 15 Jul 2026 00:00:00 GMT RPC/DCOM Endpoint Mapper helps Windows clients locate dynamic RPC services used by administration and applications. https://welbournesecurity.com/blue-team/learn/services/rpcbind/ https://welbournesecurity.com/blue-team/learn/services/rpcbind/#Learn: rpcbind Wed, 15 Jul 2026 00:00:00 GMT rpcbind maps ONC RPC program numbers to the ports where services are listening. https://welbournesecurity.com/blue-team/learn/services/rsync/ https://welbournesecurity.com/blue-team/learn/services/rsync/#Learn: rsync Wed, 15 Jul 2026 00:00:00 GMT rsync synchronises files and directory trees efficiently between systems. https://welbournesecurity.com/blue-team/learn/services/rtp-rtcp/ https://welbournesecurity.com/blue-team/learn/services/rtp-rtcp/#Learn: RTP/RTCP Wed, 15 Jul 2026 00:00:00 GMT RTP/RTCP carries real-time audio and video while RTCP reports quality and session statistics. https://welbournesecurity.com/blue-team/learn/services/saml-federation/ https://welbournesecurity.com/blue-team/learn/services/saml-federation/#Learn: SAML federation Wed, 15 Jul 2026 00:00:00 GMT SAML federation exchanges signed identity assertions between an identity provider and relying applications. https://welbournesecurity.com/blue-team/learn/services/siemens-s7comm/ https://welbournesecurity.com/blue-team/learn/services/siemens-s7comm/#Learn: Siemens S7comm Wed, 15 Jul 2026 00:00:00 GMT Siemens S7comm supports engineering and data exchange with Siemens S7 programmable controllers. https://welbournesecurity.com/blue-team/learn/services/sip/ https://welbournesecurity.com/blue-team/learn/services/sip/#Learn: SIP Wed, 15 Jul 2026 00:00:00 GMT SIP establishes, changes and ends voice or video sessions. https://welbournesecurity.com/blue-team/learn/services/smb/ https://welbournesecurity.com/blue-team/learn/services/smb/#Learn: SMB Wed, 15 Jul 2026 00:00:00 GMT SMB provides Windows file, printer and named-pipe access and supports remote administration. https://welbournesecurity.com/blue-team/learn/services/smtp/ https://welbournesecurity.com/blue-team/learn/services/smtp/#Learn: SMTP Wed, 15 Jul 2026 00:00:00 GMT SMTP moves email between servers and accepts authenticated message submission. https://welbournesecurity.com/blue-team/learn/services/snmp/ https://welbournesecurity.com/blue-team/learn/services/snmp/#Learn: SNMP Wed, 15 Jul 2026 00:00:00 GMT SNMP reads device state and receives traps from managed infrastructure. https://welbournesecurity.com/blue-team/learn/services/ssh/ https://welbournesecurity.com/blue-team/learn/services/ssh/#Learn: SSH Wed, 15 Jul 2026 00:00:00 GMT SSH provides encrypted remote shells, command execution, tunnelling and file transfer. https://welbournesecurity.com/blue-team/learn/services/syslog/ https://welbournesecurity.com/blue-team/learn/services/syslog/#Learn: Syslog Wed, 15 Jul 2026 00:00:00 GMT Syslog transports operational and security messages from systems to collectors. https://welbournesecurity.com/blue-team/learn/services/tacacs-plus/ https://welbournesecurity.com/blue-team/learn/services/tacacs-plus/#Learn: TACACS+ Wed, 15 Jul 2026 00:00:00 GMT TACACS+ centralises administrative access decisions for network devices. https://welbournesecurity.com/blue-team/learn/services/telnet/ https://welbournesecurity.com/blue-team/learn/services/telnet/#Learn: Telnet Wed, 15 Jul 2026 00:00:00 GMT Telnet provides a plaintext interactive terminal to remote systems and devices. https://welbournesecurity.com/blue-team/learn/services/tftp/ https://welbournesecurity.com/blue-team/learn/services/tftp/#Learn: TFTP Wed, 15 Jul 2026 00:00:00 GMT TFTP transfers simple files for boot, firmware and device configuration workflows. https://welbournesecurity.com/blue-team/learn/services/vnc/ https://welbournesecurity.com/blue-team/learn/services/vnc/#Learn: VNC Wed, 15 Jul 2026 00:00:00 GMT VNC shares graphical desktops using the Remote Framebuffer protocol. https://welbournesecurity.com/blue-team/learn/services/winrm-wsman/ https://welbournesecurity.com/blue-team/learn/services/winrm-wsman/#Learn: WinRM/WS-Man Wed, 15 Jul 2026 00:00:00 GMT WinRM/WS-Man provides standards-based remote management and PowerShell remoting. https://welbournesecurity.com/blue-team/learn/services/wireguard/ https://welbournesecurity.com/blue-team/learn/services/wireguard/#Learn: WireGuard Wed, 15 Jul 2026 00:00:00 GMT WireGuard creates lightweight encrypted IP tunnels using static public keys. https://welbournesecurity.com/blue-team/learn/attacks/ad-cs-certificate-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/ad-cs-certificate-abuse/#Learn: AD CS certificate abuse Wed, 15 Jul 2026 00:00:00 GMT AD CS certificate abuse uses certificate template and enrolment policy abuse to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/adminsdholder-and-sdprop-persistence/ https://welbournesecurity.com/blue-team/learn/attacks/adminsdholder-and-sdprop-persistence/#Learn: AdminSDHolder and SDProp persistence Wed, 15 Jul 2026 00:00:00 GMT AdminSDHolder and SDProp persistence uses AdminSDHolder ACL propagation through SDProp to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/adversary-in-the-middle-phishing-and-cookie-theft/ https://welbournesecurity.com/blue-team/learn/attacks/adversary-in-the-middle-phishing-and-cookie-theft/#Learn: Adversary-in-the-middle phishing and cookie theft Wed, 15 Jul 2026 00:00:00 GMT Adversary-in-the-middle phishing and cookie theft uses reverse-proxy interception of authentication and session cookies to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/api-key-exposure-and-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/api-key-exposure-and-abuse/#Learn: API key exposure and abuse Wed, 15 Jul 2026 00:00:00 GMT API key exposure and abuse uses API key discovery followed by authenticated API calls to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/application-token-theft/ https://welbournesecurity.com/blue-team/learn/attacks/application-token-theft/#Learn: Application token theft Wed, 15 Jul 2026 00:00:00 GMT Application token theft uses bearer token capture and replay to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/arp-spoofing/ https://welbournesecurity.com/blue-team/learn/attacks/arp-spoofing/#Learn: ARP spoofing Wed, 15 Jul 2026 00:00:00 GMT ARP spoofing uses forged ARP replies that change neighbour-cache bindings to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/as-rep-roasting/ https://welbournesecurity.com/blue-team/learn/attacks/as-rep-roasting/#Learn: AS-REP roasting Wed, 15 Jul 2026 00:00:00 GMT AS-REP roasting uses Kerberos AS-REP responses for accounts without pre-authentication to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/authentication-bypass/ https://welbournesecurity.com/blue-team/learn/attacks/authentication-bypass/#Learn: Authentication bypass Wed, 15 Jul 2026 00:00:00 GMT Authentication bypass uses application logic that reaches a protected action without a valid authentication decision to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/bgp-route-hijacking/ https://welbournesecurity.com/blue-team/learn/attacks/bgp-route-hijacking/#Learn: BGP route hijacking Wed, 15 Jul 2026 00:00:00 GMT BGP route hijacking uses unauthorised BGP origin or more-specific route advertisement to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/bootkit/ https://welbournesecurity.com/blue-team/learn/attacks/bootkit/#Learn: Bootkit Wed, 15 Jul 2026 00:00:00 GMT Bootkit uses pre-operating-system code inserted into the boot chain to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/browser-credential-and-session-theft/ https://welbournesecurity.com/blue-team/learn/attacks/browser-credential-and-session-theft/#Learn: Browser credential and session theft Wed, 15 Jul 2026 00:00:00 GMT Browser credential and session theft uses browser profile, credential-store and session database access to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/brute-force-and-password-guessing/ https://welbournesecurity.com/blue-team/learn/attacks/brute-force-and-password-guessing/#Learn: Brute force and password guessing Wed, 15 Jul 2026 00:00:00 GMT Brute force and password guessing uses repeated authentication attempts against one identity to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/business-email-compromise/ https://welbournesecurity.com/blue-team/learn/attacks/business-email-compromise/#Learn: Business email compromise Wed, 15 Jul 2026 00:00:00 GMT Business email compromise uses mailbox or mail-flow manipulation using a trusted business identity to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/c2-beaconing/ https://welbournesecurity.com/blue-team/learn/attacks/c2-beaconing/#Learn: C2 beaconing Wed, 15 Jul 2026 00:00:00 GMT C2 beaconing uses periodic command-channel check-ins over an allowed protocol to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/ci-cd-secret-leakage/ https://welbournesecurity.com/blue-team/learn/attacks/ci-cd-secret-leakage/#Learn: CI/CD secret leakage Wed, 15 Jul 2026 00:00:00 GMT CI/CD secret leakage uses pipeline log, variable, artefact or repository secret exposure to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/cloud-access-key-theft/ https://welbournesecurity.com/blue-team/learn/attacks/cloud-access-key-theft/#Learn: Cloud access-key theft Wed, 15 Jul 2026 00:00:00 GMT Cloud access-key theft uses cloud access-key discovery and API use to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/cloud-account-takeover/ https://welbournesecurity.com/blue-team/learn/attacks/cloud-account-takeover/#Learn: Cloud account takeover Wed, 15 Jul 2026 00:00:00 GMT Cloud account takeover uses control-plane authentication with a compromised principal to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/cloud-audit-log-tampering/ https://welbournesecurity.com/blue-team/learn/attacks/cloud-audit-log-tampering/#Learn: Cloud audit-log tampering Wed, 15 Jul 2026 00:00:00 GMT Cloud audit-log tampering uses logging policy disablement, exclusion or trail deletion to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/cloud-iam-policy-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/cloud-iam-policy-abuse/#Learn: Cloud IAM policy abuse Wed, 15 Jul 2026 00:00:00 GMT Cloud IAM policy abuse uses IAM policy, role or trust-policy modification to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/cloud-role-privilege-escalation/ https://welbournesecurity.com/blue-team/learn/attacks/cloud-role-privilege-escalation/#Learn: Cloud role privilege escalation Wed, 15 Jul 2026 00:00:00 GMT Cloud role privilege escalation uses role assumption or permission-chain escalation to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/cold-boot-attack/ https://welbournesecurity.com/blue-team/learn/attacks/cold-boot-attack/#Learn: Cold boot attack Wed, 15 Jul 2026 00:00:00 GMT Cold boot attack uses residual encryption-key recovery from volatile memory after power interruption to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/conditional-access-policy-tampering/ https://welbournesecurity.com/blue-team/learn/attacks/conditional-access-policy-tampering/#Learn: Conditional Access policy tampering Wed, 15 Jul 2026 00:00:00 GMT Conditional Access policy tampering uses identity policy change that weakens sign-in conditions to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/container-escape/ https://welbournesecurity.com/blue-team/learn/attacks/container-escape/#Learn: Container escape Wed, 15 Jul 2026 00:00:00 GMT Container escape uses container-to-host boundary escape through a runtime or kernel weakness to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/container-runtime-socket-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/container-runtime-socket-abuse/#Learn: Container runtime socket abuse Wed, 15 Jul 2026 00:00:00 GMT Container runtime socket abuse uses privileged requests sent to an exposed container runtime socket to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/credential-stuffing/ https://welbournesecurity.com/blue-team/learn/attacks/credential-stuffing/#Learn: Credential stuffing Wed, 15 Jul 2026 00:00:00 GMT Credential stuffing uses replay of breached username and password pairs across services to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/cron-and-systemd-timer-persistence/ https://welbournesecurity.com/blue-team/learn/attacks/cron-and-systemd-timer-persistence/#Learn: Cron and systemd timer persistence Wed, 15 Jul 2026 00:00:00 GMT Cron and systemd timer persistence uses scheduled Linux execution through cron or systemd timers to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/cross-site-request-forgery/ https://welbournesecurity.com/blue-team/learn/attacks/cross-site-request-forgery/#Learn: Cross-site request forgery Wed, 15 Jul 2026 00:00:00 GMT Cross-site request forgery uses cross-origin request sent with a victim browser's ambient authority to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/cross-site-scripting/ https://welbournesecurity.com/blue-team/learn/attacks/cross-site-scripting/#Learn: Cross-site scripting Wed, 15 Jul 2026 00:00:00 GMT Cross-site scripting uses untrusted script execution inside a trusted web origin to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/cryptojacking/ https://welbournesecurity.com/blue-team/learn/attacks/cryptojacking/#Learn: Cryptojacking Wed, 15 Jul 2026 00:00:00 GMT Cryptojacking uses unauthorised compute consumption for cryptocurrency mining to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/data-exfiltration/ https://welbournesecurity.com/blue-team/learn/attacks/data-exfiltration/#Learn: Data exfiltration Wed, 15 Jul 2026 00:00:00 GMT Data exfiltration uses staged information transferred across an external trust boundary to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/dcshadow/ https://welbournesecurity.com/blue-team/learn/attacks/dcshadow/#Learn: DCShadow Wed, 15 Jul 2026 00:00:00 GMT DCShadow uses rogue domain-controller registration followed by directory replication changes to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/dcsync/ https://welbournesecurity.com/blue-team/learn/attacks/dcsync/#Learn: DCSync Wed, 15 Jul 2026 00:00:00 GMT DCSync uses directory replication requests for credential data to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/dhcp-spoofing/ https://welbournesecurity.com/blue-team/learn/attacks/dhcp-spoofing/#Learn: DHCP spoofing Wed, 15 Jul 2026 00:00:00 GMT DHCP spoofing uses unauthorised DHCP offers that replace gateway or resolver settings to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/dll-search-order-hijacking-and-side-loading/ https://welbournesecurity.com/blue-team/learn/attacks/dll-search-order-hijacking-and-side-loading/#Learn: DLL search-order hijacking and side-loading Wed, 15 Jul 2026 00:00:00 GMT DLL search-order hijacking and side-loading uses trusted process loading of an attacker-controlled library to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/dns-cache-poisoning/ https://welbournesecurity.com/blue-team/learn/attacks/dns-cache-poisoning/#Learn: DNS cache poisoning Wed, 15 Jul 2026 00:00:00 GMT DNS cache poisoning uses forged DNS data accepted into a resolver cache to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/dns-tunnelling/ https://welbournesecurity.com/blue-team/learn/attacks/dns-tunnelling/#Learn: DNS tunnelling Wed, 15 Jul 2026 00:00:00 GMT DNS tunnelling uses encoded command or data carried in DNS names and responses to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/domain-trust-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/domain-trust-abuse/#Learn: Domain trust abuse Wed, 15 Jul 2026 00:00:00 GMT Domain trust abuse uses authentication or authorisation across an abused domain trust to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/drive-by-download/ https://welbournesecurity.com/blue-team/learn/attacks/drive-by-download/#Learn: Drive-by download Wed, 15 Jul 2026 00:00:00 GMT Drive-by download uses browser-delivered content that triggers an unwanted download or execution chain to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/engineering-workstation-compromise/ https://welbournesecurity.com/blue-team/learn/attacks/engineering-workstation-compromise/#Learn: Engineering workstation compromise Wed, 15 Jul 2026 00:00:00 GMT Engineering workstation compromise uses engineering software and project access used to reach control assets to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/evil-maid/ https://welbournesecurity.com/blue-team/learn/attacks/evil-maid/#Learn: Evil Maid Wed, 15 Jul 2026 00:00:00 GMT Evil Maid uses unattended-device tampering with the boot or authentication chain to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/evil-twin/ https://welbournesecurity.com/blue-team/learn/attacks/evil-twin/#Learn: Evil Twin Wed, 15 Jul 2026 00:00:00 GMT Evil Twin uses rogue wireless network impersonating a trusted SSID to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/exposed-container-registries/ https://welbournesecurity.com/blue-team/learn/attacks/exposed-container-registries/#Learn: Exposed container registries Wed, 15 Jul 2026 00:00:00 GMT Exposed container registries uses unauthorised registry enumeration, pull or push operations to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/exposed-object-storage/ https://welbournesecurity.com/blue-team/learn/attacks/exposed-object-storage/#Learn: Exposed object storage Wed, 15 Jul 2026 00:00:00 GMT Exposed object storage uses public or over-permissive object-store access to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/file-inclusion/ https://welbournesecurity.com/blue-team/learn/attacks/file-inclusion/#Learn: File inclusion Wed, 15 Jul 2026 00:00:00 GMT File inclusion uses application-controlled inclusion of a local or remote file to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/golden-saml/ https://welbournesecurity.com/blue-team/learn/attacks/golden-saml/#Learn: Golden SAML Wed, 15 Jul 2026 00:00:00 GMT Golden SAML uses forged federation assertions signed with compromised identity-provider material to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/golden-ticket/ https://welbournesecurity.com/blue-team/learn/attacks/golden-ticket/#Learn: Golden Ticket Wed, 15 Jul 2026 00:00:00 GMT Golden Ticket uses forged Kerberos ticket-granting tickets using the domain KDC key to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/graphql-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/graphql-abuse/#Learn: GraphQL abuse Wed, 15 Jul 2026 00:00:00 GMT GraphQL abuse uses GraphQL query, mutation, batching or introspection misuse to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/group-policy-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/group-policy-abuse/#Learn: Group Policy abuse Wed, 15 Jul 2026 00:00:00 GMT Group Policy abuse uses malicious change distributed through a Group Policy Object to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/hardware-implant/ https://welbournesecurity.com/blue-team/learn/attacks/hardware-implant/#Learn: Hardware implant Wed, 15 Jul 2026 00:00:00 GMT Hardware implant uses physical insertion of a device that observes or alters a trusted path to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/http-request-smuggling/ https://welbournesecurity.com/blue-team/learn/attacks/http-request-smuggling/#Learn: HTTP request smuggling Wed, 15 Jul 2026 00:00:00 GMT HTTP request smuggling uses front-end and back-end disagreement about HTTP message boundaries to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/idor-and-bola/ https://welbournesecurity.com/blue-team/learn/attacks/idor-and-bola/#Learn: IDOR and BOLA Wed, 15 Jul 2026 00:00:00 GMT IDOR and BOLA uses direct object reference accepted without object-level authorisation to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/inhibit-system-recovery/ https://welbournesecurity.com/blue-team/learn/attacks/inhibit-system-recovery/#Learn: Inhibit system recovery Wed, 15 Jul 2026 00:00:00 GMT Inhibit system recovery uses removal or disablement of backups and recovery paths to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/insecure-deserialization/ https://welbournesecurity.com/blue-team/learn/attacks/insecure-deserialization/#Learn: Insecure deserialization Wed, 15 Jul 2026 00:00:00 GMT Insecure deserialization uses attacker-controlled object data processed by an unsafe deserialiser to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/instance-metadata-credential-theft/ https://welbournesecurity.com/blue-team/learn/attacks/instance-metadata-credential-theft/#Learn: Instance metadata credential theft Wed, 15 Jul 2026 00:00:00 GMT Instance metadata credential theft uses workload request to a cloud instance metadata credential endpoint to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/ipmi-and-bmc-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/ipmi-and-bmc-abuse/#Learn: IPMI and BMC abuse Wed, 15 Jul 2026 00:00:00 GMT IPMI and BMC abuse uses BMC authentication and remote-management action outside approved administration to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/jwt-forgery-and-algorithm-confusion/ https://welbournesecurity.com/blue-team/learn/attacks/jwt-forgery-and-algorithm-confusion/#Learn: JWT forgery and algorithm confusion Wed, 15 Jul 2026 00:00:00 GMT JWT forgery and algorithm confusion uses token-signature or algorithm validation failure to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/kerberoasting/ https://welbournesecurity.com/blue-team/learn/attacks/kerberoasting/#Learn: Kerberoasting Wed, 15 Jul 2026 00:00:00 GMT Kerberoasting uses Kerberos service-ticket request followed by offline password recovery to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/kerberos-delegation-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/kerberos-delegation-abuse/#Learn: Kerberos delegation abuse Wed, 15 Jul 2026 00:00:00 GMT Kerberos delegation abuse uses delegated Kerberos credentials used beyond their intended service path to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/kubernetes-admission-controller-and-webhook-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/kubernetes-admission-controller-and-webhook-abuse/#Learn: Kubernetes admission-controller and webhook abuse Wed, 15 Jul 2026 00:00:00 GMT Kubernetes admission-controller and webhook abuse uses admission configuration or webhook response that alters cluster decisions to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/kubernetes-rbac-privilege-escalation/ https://welbournesecurity.com/blue-team/learn/attacks/kubernetes-rbac-privilege-escalation/#Learn: Kubernetes RBAC privilege escalation Wed, 15 Jul 2026 00:00:00 GMT Kubernetes RBAC privilege escalation uses RBAC binding or permission chain that grants stronger cluster rights to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/kubernetes-secrets-theft/ https://welbournesecurity.com/blue-team/learn/attacks/kubernetes-secrets-theft/#Learn: Kubernetes Secrets theft Wed, 15 Jul 2026 00:00:00 GMT Kubernetes Secrets theft uses Kubernetes API or datastore access to Secret objects to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/kubernetes-service-account-token-theft/ https://welbournesecurity.com/blue-team/learn/attacks/kubernetes-service-account-token-theft/#Learn: Kubernetes service account token theft Wed, 15 Jul 2026 00:00:00 GMT Kubernetes service account token theft uses service-account token discovery and API replay to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/launchagent-and-launchdaemon-persistence/ https://welbournesecurity.com/blue-team/learn/attacks/launchagent-and-launchdaemon-persistence/#Learn: LaunchAgent and LaunchDaemon persistence Wed, 15 Jul 2026 00:00:00 GMT LaunchAgent and LaunchDaemon persistence uses macOS launchd property-list persistence to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/living-off-the-land-binaries/ https://welbournesecurity.com/blue-team/learn/attacks/living-off-the-land-binaries/#Learn: Living off the land binaries Wed, 15 Jul 2026 00:00:00 GMT Living off the land binaries uses trusted signed utility used for an unintended execution or transfer action to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/llmnr-nbt-ns-poisoning/ https://welbournesecurity.com/blue-team/learn/attacks/llmnr-nbt-ns-poisoning/#Learn: LLMNR/NBT-NS poisoning Wed, 15 Jul 2026 00:00:00 GMT LLMNR/NBT-NS poisoning uses forged local name-resolution replies that redirect authentication to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/log-clearing-and-defence-impairment/ https://welbournesecurity.com/blue-team/learn/attacks/log-clearing-and-defence-impairment/#Learn: Log clearing and defence impairment Wed, 15 Jul 2026 00:00:00 GMT Log clearing and defence impairment uses audit-record deletion or telemetry-control modification to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/lsass-credential-dumping/ https://welbournesecurity.com/blue-team/learn/attacks/lsass-credential-dumping/#Learn: LSASS credential dumping Wed, 15 Jul 2026 00:00:00 GMT LSASS credential dumping uses access to credential material held by LSASS memory to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/malicious-documents-and-macros/ https://welbournesecurity.com/blue-team/learn/attacks/malicious-documents-and-macros/#Learn: Malicious documents and macros Wed, 15 Jul 2026 00:00:00 GMT Malicious documents and macros uses document content that invokes script, template or child-process behaviour to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/mass-assignment/ https://welbournesecurity.com/blue-team/learn/attacks/mass-assignment/#Learn: Mass assignment Wed, 15 Jul 2026 00:00:00 GMT Mass assignment uses automatic object binding that accepts security-sensitive fields to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/mfa-fatigue/ https://welbournesecurity.com/blue-team/learn/attacks/mfa-fatigue/#Learn: MFA fatigue Wed, 15 Jul 2026 00:00:00 GMT MFA fatigue uses repeated unsolicited approval prompts designed to obtain one acceptance to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/mfa-method-registration-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/mfa-method-registration-abuse/#Learn: MFA method registration abuse Wed, 15 Jul 2026 00:00:00 GMT MFA method registration abuse uses new authentication method registered under a compromised identity to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/ntdsdit-theft/ https://welbournesecurity.com/blue-team/learn/attacks/ntdsdit-theft/#Learn: NTDS.dit theft Wed, 15 Jul 2026 00:00:00 GMT NTDS.dit theft uses copy or backup access to the Active Directory database and supporting keys to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/ntlm-relay/ https://welbournesecurity.com/blue-team/learn/attacks/ntlm-relay/#Learn: NTLM relay Wed, 15 Jul 2026 00:00:00 GMT NTLM relay uses forwarding of NTLM authentication to another accepting service to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/oauth-consent-phishing/ https://welbournesecurity.com/blue-team/learn/attacks/oauth-consent-phishing/#Learn: OAuth consent phishing Wed, 15 Jul 2026 00:00:00 GMT OAuth consent phishing uses deceptive OAuth grant consent for a malicious application to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/on-path-attack/ https://welbournesecurity.com/blue-team/learn/attacks/on-path-attack/#Learn: On-path attack Wed, 15 Jul 2026 00:00:00 GMT On-path attack uses traffic interception or alteration between communicating peers to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/os-command-injection/ https://welbournesecurity.com/blue-team/learn/attacks/os-command-injection/#Learn: OS command injection Wed, 15 Jul 2026 00:00:00 GMT OS command injection uses untrusted application input interpreted by an operating-system command processor to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/ospf-route-manipulation/ https://welbournesecurity.com/blue-team/learn/attacks/ospf-route-manipulation/#Learn: OSPF route manipulation Wed, 15 Jul 2026 00:00:00 GMT OSPF route manipulation uses forged or unauthorised OSPF adjacency and link-state information to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/overpass-the-hash/ https://welbournesecurity.com/blue-team/learn/attacks/overpass-the-hash/#Learn: Overpass the Hash Wed, 15 Jul 2026 00:00:00 GMT Overpass the Hash uses NTLM key material used to obtain Kerberos tickets to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/pam-backdoors-and-credential-interception/ https://welbournesecurity.com/blue-team/learn/attacks/pam-backdoors-and-credential-interception/#Learn: PAM backdoors and credential interception Wed, 15 Jul 2026 00:00:00 GMT PAM backdoors and credential interception uses malicious PAM module or configuration in the authentication stack to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/pass-the-hash/ https://welbournesecurity.com/blue-team/learn/attacks/pass-the-hash/#Learn: Pass the Hash Wed, 15 Jul 2026 00:00:00 GMT Pass the Hash uses NTLM credential material replay without the plaintext password to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/pass-the-ticket/ https://welbournesecurity.com/blue-team/learn/attacks/pass-the-ticket/#Learn: Pass the Ticket Wed, 15 Jul 2026 00:00:00 GMT Pass the Ticket uses stolen Kerberos ticket inserted into another logon session to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/password-spraying/ https://welbournesecurity.com/blue-team/learn/attacks/password-spraying/#Learn: Password spraying Wed, 15 Jul 2026 00:00:00 GMT Password spraying uses one or a few passwords tried across many identities to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/path-traversal/ https://welbournesecurity.com/blue-team/learn/attacks/path-traversal/#Learn: Path traversal Wed, 15 Jul 2026 00:00:00 GMT Path traversal uses path normalisation weakness that escapes an intended directory to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/phishing/ https://welbournesecurity.com/blue-team/learn/attacks/phishing/#Learn: Phishing Wed, 15 Jul 2026 00:00:00 GMT Phishing uses deceptive message or site that solicits an unsafe action to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/plc-logic-modification/ https://welbournesecurity.com/blue-team/learn/attacks/plc-logic-modification/#Learn: PLC logic modification Wed, 15 Jul 2026 00:00:00 GMT PLC logic modification uses unauthorised download or edit of controller logic to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/poisoned-container-images/ https://welbournesecurity.com/blue-team/learn/attacks/poisoned-container-images/#Learn: Poisoned container images Wed, 15 Jul 2026 00:00:00 GMT Poisoned container images uses malicious content introduced into a trusted container image path to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/port-scanning-and-service-discovery/ https://welbournesecurity.com/blue-team/learn/attacks/port-scanning-and-service-discovery/#Learn: Port scanning and service discovery Wed, 15 Jul 2026 00:00:00 GMT Port scanning and service discovery uses connection probes used to enumerate reachable listeners to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/powershell-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/powershell-abuse/#Learn: PowerShell abuse Wed, 15 Jul 2026 00:00:00 GMT PowerShell abuse uses PowerShell host and .NET capabilities used for unauthorised actions to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/process-injection/ https://welbournesecurity.com/blue-team/learn/attacks/process-injection/#Learn: Process injection Wed, 15 Jul 2026 00:00:00 GMT Process injection uses code or execution state placed inside another process to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/public-cloud-snapshot-sharing/ https://welbournesecurity.com/blue-team/learn/attacks/public-cloud-snapshot-sharing/#Learn: Public cloud snapshot sharing Wed, 15 Jul 2026 00:00:00 GMT Public cloud snapshot sharing uses snapshot permissions changed to expose data to another principal to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/ransomware/ https://welbournesecurity.com/blue-team/learn/attacks/ransomware/#Learn: Ransomware Wed, 15 Jul 2026 00:00:00 GMT Ransomware uses file encryption paired with recovery disruption and extortion to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/rdp-abuse-and-session-hijacking/ https://welbournesecurity.com/blue-team/learn/attacks/rdp-abuse-and-session-hijacking/#Learn: RDP abuse and session hijacking Wed, 15 Jul 2026 00:00:00 GMT RDP abuse and session hijacking uses remote desktop authentication or existing session control to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/registry-run-key-persistence/ https://welbournesecurity.com/blue-team/learn/attacks/registry-run-key-persistence/#Learn: Registry Run key persistence Wed, 15 Jul 2026 00:00:00 GMT Registry Run key persistence uses Windows logon-start registry value modification to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/rogue-access-point/ https://welbournesecurity.com/blue-team/learn/attacks/rogue-access-point/#Learn: Rogue access point Wed, 15 Jul 2026 00:00:00 GMT Rogue access point uses unauthorised wireless access point bridging or impersonating a network to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/rtp-media-interception-and-injection/ https://welbournesecurity.com/blue-team/learn/attacks/rtp-media-interception-and-injection/#Learn: RTP media interception and injection Wed, 15 Jul 2026 00:00:00 GMT RTP media interception and injection uses RTP stream discovery followed by packet capture or injection to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/sam-and-lsa-secrets-dumping/ https://welbournesecurity.com/blue-team/learn/attacks/sam-and-lsa-secrets-dumping/#Learn: SAM and LSA secrets dumping Wed, 15 Jul 2026 00:00:00 GMT SAM and LSA secrets dumping uses offline or privileged access to local account and LSA secret stores to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/scheduled-task-persistence/ https://welbournesecurity.com/blue-team/learn/attacks/scheduled-task-persistence/#Learn: Scheduled task persistence Wed, 15 Jul 2026 00:00:00 GMT Scheduled task persistence uses scheduled task registration that triggers later execution to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/secrets-manager-theft/ https://welbournesecurity.com/blue-team/learn/attacks/secrets-manager-theft/#Learn: Secrets-manager theft Wed, 15 Jul 2026 00:00:00 GMT Secrets-manager theft uses authorised or stolen identity reading managed secret values to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/server-side-request-forgery/ https://welbournesecurity.com/blue-team/learn/attacks/server-side-request-forgery/#Learn: Server-side request forgery Wed, 15 Jul 2026 00:00:00 GMT Server-side request forgery uses server-originated request directed to an attacker-selected destination to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/serverless-function-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/serverless-function-abuse/#Learn: Serverless function abuse Wed, 15 Jul 2026 00:00:00 GMT Serverless function abuse uses function code, trigger or identity changed for unauthorised execution to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/session-fixation/ https://welbournesecurity.com/blue-team/learn/attacks/session-fixation/#Learn: Session fixation Wed, 15 Jul 2026 00:00:00 GMT Session fixation uses victim authentication bound to a session identifier chosen earlier to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/session-hijacking/ https://welbournesecurity.com/blue-team/learn/attacks/session-hijacking/#Learn: Session hijacking Wed, 15 Jul 2026 00:00:00 GMT Session hijacking uses stolen session state replayed to an accepting application to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/shadow-credentials/ https://welbournesecurity.com/blue-team/learn/attacks/shadow-credentials/#Learn: Shadow Credentials Wed, 15 Jul 2026 00:00:00 GMT Shadow Credentials uses directory key-credential link modified to enable certificate authentication to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/silver-ticket/ https://welbournesecurity.com/blue-team/learn/attacks/silver-ticket/#Learn: Silver Ticket Wed, 15 Jul 2026 00:00:00 GMT Silver Ticket uses forged Kerberos service ticket using a service account key to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/sip-registration-abuse-and-toll-fraud/ https://welbournesecurity.com/blue-team/learn/attacks/sip-registration-abuse-and-toll-fraud/#Learn: SIP registration abuse and toll fraud Wed, 15 Jul 2026 00:00:00 GMT SIP registration abuse and toll fraud uses unauthorised SIP registration and call placement to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/skeleton-key/ https://welbournesecurity.com/blue-team/learn/attacks/skeleton-key/#Learn: Skeleton Key Wed, 15 Jul 2026 00:00:00 GMT Skeleton Key uses domain-controller authentication logic modified to accept a secondary secret to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/smb-and-admin-share-lateral-movement/ https://welbournesecurity.com/blue-team/learn/attacks/smb-and-admin-share-lateral-movement/#Learn: SMB and admin share lateral movement Wed, 15 Jul 2026 00:00:00 GMT SMB and admin share lateral movement uses remote SMB administrative share and service-control activity to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/snmp-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/snmp-abuse/#Learn: SNMP abuse Wed, 15 Jul 2026 00:00:00 GMT SNMP abuse uses SNMP enumeration or write operation using exposed community or user credentials to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/spearphishing/ https://welbournesecurity.com/blue-team/learn/attacks/spearphishing/#Learn: Spearphishing Wed, 15 Jul 2026 00:00:00 GMT Spearphishing uses targeted deceptive delivery tailored to a person or organisation to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/sql-injection/ https://welbournesecurity.com/blue-team/learn/attacks/sql-injection/#Learn: SQL injection Wed, 15 Jul 2026 00:00:00 GMT SQL injection uses untrusted input changing the structure of a database query to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/ssh-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/ssh-abuse/#Learn: SSH abuse Wed, 15 Jul 2026 00:00:00 GMT SSH abuse uses unauthorised SSH authentication, forwarding or remote command execution to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/ssh-authorized-keys-persistence/ https://welbournesecurity.com/blue-team/learn/attacks/ssh-authorized-keys-persistence/#Learn: SSH authorized_keys persistence Wed, 15 Jul 2026 00:00:00 GMT SSH authorized_keys persistence uses public key added to an SSH authorised-keys file to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/startup-folder-persistence/ https://welbournesecurity.com/blue-team/learn/attacks/startup-folder-persistence/#Learn: Startup folder persistence Wed, 15 Jul 2026 00:00:00 GMT Startup folder persistence uses executable or shortcut placed in a Windows Startup folder to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/supply-chain-compromise/ https://welbournesecurity.com/blue-team/learn/attacks/supply-chain-compromise/#Learn: Supply-chain compromise Wed, 15 Jul 2026 00:00:00 GMT Supply-chain compromise uses trusted supplier, build or update path modified before delivery to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/unauthorised-control-commands-and-safety-system-manipulation/ https://welbournesecurity.com/blue-team/learn/attacks/unauthorised-control-commands-and-safety-system-manipulation/#Learn: Unauthorised control commands and safety-system manipulation Wed, 15 Jul 2026 00:00:00 GMT Unauthorised control commands and safety-system manipulation uses industrial command or safety configuration changed outside authorised control to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/usb-drop-and-baiting/ https://welbournesecurity.com/blue-team/learn/attacks/usb-drop-and-baiting/#Learn: USB drop and baiting Wed, 15 Jul 2026 00:00:00 GMT USB drop and baiting uses removable media used to induce connection or file execution to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/vlan-hopping/ https://welbournesecurity.com/blue-team/learn/attacks/vlan-hopping/#Learn: VLAN hopping Wed, 15 Jul 2026 00:00:00 GMT VLAN hopping uses frame tagging or trunk negotiation used to cross a VLAN boundary to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/vpn-account-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/vpn-account-abuse/#Learn: VPN account abuse Wed, 15 Jul 2026 00:00:00 GMT VPN account abuse uses stolen VPN identity used to enter a protected network to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/web-shell/ https://welbournesecurity.com/blue-team/learn/attacks/web-shell/#Learn: Web shell Wed, 15 Jul 2026 00:00:00 GMT Web shell uses server-side script providing persistent remote request execution to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/wi-fi-deauthentication/ https://welbournesecurity.com/blue-team/learn/attacks/wi-fi-deauthentication/#Learn: Wi-Fi deauthentication Wed, 15 Jul 2026 00:00:00 GMT Wi-Fi deauthentication uses forged 802.11 management frames that disconnect clients to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/windows-service-execution/ https://welbournesecurity.com/blue-team/learn/attacks/windows-service-execution/#Learn: Windows service execution Wed, 15 Jul 2026 00:00:00 GMT Windows service execution uses remote Service Control Manager creation and start operations to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/wiper-and-destructive-malware/ https://welbournesecurity.com/blue-team/learn/attacks/wiper-and-destructive-malware/#Learn: Wiper and destructive malware Wed, 15 Jul 2026 00:00:00 GMT Wiper and destructive malware uses deliberate destruction of files, disks or boot data to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/wmi-event-subscription-persistence/ https://welbournesecurity.com/blue-team/learn/attacks/wmi-event-subscription-persistence/#Learn: WMI event subscription persistence Wed, 15 Jul 2026 00:00:00 GMT WMI event subscription persistence uses permanent WMI filter, consumer and binding registration to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/workload-identity-abuse/ https://welbournesecurity.com/blue-team/learn/attacks/workload-identity-abuse/#Learn: Workload identity abuse Wed, 15 Jul 2026 00:00:00 GMT Workload identity abuse uses workload token or federated identity used against cloud APIs to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/attacks/xml-external-entity-injection/ https://welbournesecurity.com/blue-team/learn/attacks/xml-external-entity-injection/#Learn: XML external entity injection Wed, 15 Jul 2026 00:00:00 GMT XML external entity injection uses XML parser resolution of attacker-controlled external entities to cross a trust boundary, change security state or gain unauthorised capability. https://welbournesecurity.com/blue-team/learn/artefacts/ad-cs-ca-private-keys-and-certificates/ https://welbournesecurity.com/blue-team/learn/artefacts/ad-cs-ca-private-keys-and-certificates/#Learn: AD CS CA private keys and certificates Wed, 15 Jul 2026 00:00:00 GMT AD CS CA private keys and certificates can expose keys capable of issuing trusted authentication certificates. https://welbournesecurity.com/blue-team/learn/artefacts/application-access-and-refresh-tokens/ https://welbournesecurity.com/blue-team/learn/artefacts/application-access-and-refresh-tokens/#Learn: Application access and refresh tokens Wed, 15 Jul 2026 00:00:00 GMT Application access and refresh tokens can expose delegated access that may bypass a fresh password prompt. https://welbournesecurity.com/blue-team/learn/artefacts/aws-ec2-instance-profile-credentials/ https://welbournesecurity.com/blue-team/learn/artefacts/aws-ec2-instance-profile-credentials/#Learn: AWS EC2 instance-profile credentials Wed, 15 Jul 2026 00:00:00 GMT AWS EC2 instance-profile credentials can expose temporary AWS access key, secret key and session token material associated with an instance role. https://welbournesecurity.com/blue-team/learn/artefacts/azure-managed-identity-access-tokens/ https://welbournesecurity.com/blue-team/learn/artefacts/azure-managed-identity-access-tokens/#Learn: Azure managed-identity access tokens Wed, 15 Jul 2026 00:00:00 GMT Azure managed-identity access tokens can expose short-lived Microsoft Entra access tokens issued to an Azure managed identity. https://welbournesecurity.com/blue-team/learn/artefacts/browser-cookies-and-session-stores/ https://welbournesecurity.com/blue-team/learn/artefacts/browser-cookies-and-session-stores/#Learn: Browser cookies and session stores Wed, 15 Jul 2026 00:00:00 GMT Browser cookies and session stores can expose authenticated web sessions and refresh state. https://welbournesecurity.com/blue-team/learn/artefacts/browser-password-databases/ https://welbournesecurity.com/blue-team/learn/artefacts/browser-password-databases/#Learn: Browser password databases Wed, 15 Jul 2026 00:00:00 GMT Browser password databases can expose saved usernames and encrypted passwords. https://welbournesecurity.com/blue-team/learn/artefacts/cached-domain-credentials/ https://welbournesecurity.com/blue-team/learn/artefacts/cached-domain-credentials/#Learn: Cached domain credentials Wed, 15 Jul 2026 00:00:00 GMT Cached domain credentials can expose offline domain logon verifiers and account context. https://welbournesecurity.com/blue-team/learn/artefacts/ci-cd-runner-and-pipeline-secrets/ https://welbournesecurity.com/blue-team/learn/artefacts/ci-cd-runner-and-pipeline-secrets/#Learn: CI/CD runner and pipeline secrets Wed, 15 Jul 2026 00:00:00 GMT CI/CD runner and pipeline secrets can expose deployment keys, signing material and automation tokens. https://welbournesecurity.com/blue-team/learn/artefacts/cloud-cli-credential-caches-and-files/ https://welbournesecurity.com/blue-team/learn/artefacts/cloud-cli-credential-caches-and-files/#Learn: Cloud CLI credential caches and files Wed, 15 Jul 2026 00:00:00 GMT Cloud CLI credential caches and files can expose cloud access keys, refresh tokens and active profile context. https://welbournesecurity.com/blue-team/learn/artefacts/code-signing-certificates-and-private-keys/ https://welbournesecurity.com/blue-team/learn/artefacts/code-signing-certificates-and-private-keys/#Learn: Code-signing certificates and private keys Wed, 15 Jul 2026 00:00:00 GMT Code-signing certificates and private keys can expose private keys that let software or packages appear to come from a trusted publisher. https://welbournesecurity.com/blue-team/learn/artefacts/container-mounted-secrets-and-environment-values/ https://welbournesecurity.com/blue-team/learn/artefacts/container-mounted-secrets-and-environment-values/#Learn: Container-mounted secrets and environment values Wed, 15 Jul 2026 00:00:00 GMT Container-mounted secrets and environment values can expose runtime credentials injected into workloads. https://welbournesecurity.com/blue-team/learn/artefacts/database-backups-and-dumps/ https://welbournesecurity.com/blue-team/learn/artefacts/database-backups-and-dumps/#Learn: Database backups and dumps Wed, 15 Jul 2026 00:00:00 GMT Database backups and dumps can expose bulk application data, credentials and business records. https://welbournesecurity.com/blue-team/learn/artefacts/docker-configjson-and-registry-credentials/ https://welbournesecurity.com/blue-team/learn/artefacts/docker-configjson-and-registry-credentials/#Learn: Docker config.json and registry credentials Wed, 15 Jul 2026 00:00:00 GMT Docker config.json and registry credentials can expose container registry credentials and helper references. https://welbournesecurity.com/blue-team/learn/artefacts/dpapi-master-keys-and-credential-blobs/ https://welbournesecurity.com/blue-team/learn/artefacts/dpapi-master-keys-and-credential-blobs/#Learn: DPAPI master keys and credential blobs Wed, 15 Jul 2026 00:00:00 GMT DPAPI master keys and credential blobs can expose keys and encrypted blobs used by Windows applications. https://welbournesecurity.com/blue-team/learn/artefacts/environment-files-and-application-configuration-secrets/ https://welbournesecurity.com/blue-team/learn/artefacts/environment-files-and-application-configuration-secrets/#Learn: Environment files and application configuration secrets Wed, 15 Jul 2026 00:00:00 GMT Environment files and application configuration secrets can expose database strings, API keys, tokens and application secrets. https://welbournesecurity.com/blue-team/learn/artefacts/etc-shadow/ https://welbournesecurity.com/blue-team/learn/artefacts/etc-shadow/#Learn: /etc/shadow Wed, 15 Jul 2026 00:00:00 GMT /etc/shadow can expose Linux password hashes and account ageing data. https://welbournesecurity.com/blue-team/learn/artefacts/git-credential-stores-and-personal-access-tokens/ https://welbournesecurity.com/blue-team/learn/artefacts/git-credential-stores-and-personal-access-tokens/#Learn: Git credential stores and personal access tokens Wed, 15 Jul 2026 00:00:00 GMT Git credential stores and personal access tokens can expose repository credentials and personal access tokens. https://welbournesecurity.com/blue-team/learn/artefacts/google-cloud-service-account-keys-and-workload-tokens/ https://welbournesecurity.com/blue-team/learn/artefacts/google-cloud-service-account-keys-and-workload-tokens/#Learn: Google Cloud service-account keys and workload tokens Wed, 15 Jul 2026 00:00:00 GMT Google Cloud service-account keys and workload tokens can expose Google Cloud private keys or temporary OAuth access tokens representing a service account. https://welbournesecurity.com/blue-team/learn/artefacts/group-policy-preferences-cpassword/ https://welbournesecurity.com/blue-team/learn/artefacts/group-policy-preferences-cpassword/#Learn: Group Policy Preferences cpassword Wed, 15 Jul 2026 00:00:00 GMT Group Policy Preferences cpassword can expose legacy encrypted passwords distributed through Group Policy Preferences. https://welbournesecurity.com/blue-team/learn/artefacts/kerberos-ticket-cache/ https://welbournesecurity.com/blue-team/learn/artefacts/kerberos-ticket-cache/#Learn: Kerberos ticket cache Wed, 15 Jul 2026 00:00:00 GMT Kerberos ticket cache can expose TGTs and service tickets that can represent authenticated sessions. https://welbournesecurity.com/blue-team/learn/artefacts/kubernetes-client-certificates-and-private-keys/ https://welbournesecurity.com/blue-team/learn/artefacts/kubernetes-client-certificates-and-private-keys/#Learn: Kubernetes client certificates and private keys Wed, 15 Jul 2026 00:00:00 GMT Kubernetes client certificates and private keys can expose client identity material that may authorise direct Kubernetes API access. https://welbournesecurity.com/blue-team/learn/artefacts/kubernetes-kubeconfig/ https://welbournesecurity.com/blue-team/learn/artefacts/kubernetes-kubeconfig/#Learn: Kubernetes kubeconfig Wed, 15 Jul 2026 00:00:00 GMT Kubernetes kubeconfig can expose cluster endpoints, identities, certificates and bearer tokens. https://welbournesecurity.com/blue-team/learn/artefacts/kubernetes-secrets-objects/ https://welbournesecurity.com/blue-team/learn/artefacts/kubernetes-secrets-objects/#Learn: Kubernetes Secrets objects Wed, 15 Jul 2026 00:00:00 GMT Kubernetes Secrets objects can expose application passwords, keys, certificates and tokens stored as Kubernetes Secret data. https://welbournesecurity.com/blue-team/learn/artefacts/kubernetes-service-account-tokens/ https://welbournesecurity.com/blue-team/learn/artefacts/kubernetes-service-account-tokens/#Learn: Kubernetes service account tokens Wed, 15 Jul 2026 00:00:00 GMT Kubernetes service account tokens can expose workload identity tokens and cluster API access. https://welbournesecurity.com/blue-team/learn/artefacts/lsass-memory/ https://welbournesecurity.com/blue-team/learn/artefacts/lsass-memory/#Learn: LSASS memory Wed, 15 Jul 2026 00:00:00 GMT LSASS memory can expose active logon sessions, tickets and credential material. https://welbournesecurity.com/blue-team/learn/artefacts/macos-keychain/ https://welbournesecurity.com/blue-team/learn/artefacts/macos-keychain/#Learn: macOS Keychain Wed, 15 Jul 2026 00:00:00 GMT macOS Keychain can expose passwords, certificates, keys and application secrets. https://welbournesecurity.com/blue-team/learn/artefacts/network-device-configuration-backups/ https://welbournesecurity.com/blue-team/learn/artefacts/network-device-configuration-backups/#Learn: Network-device configuration backups Wed, 15 Jul 2026 00:00:00 GMT Network-device configuration backups can expose device credentials, addressing, routing, trust relationships and management policy. https://welbournesecurity.com/blue-team/learn/artefacts/ntds-dit/ https://welbournesecurity.com/blue-team/learn/artefacts/ntds-dit/#Learn: NTDS.dit Wed, 15 Jul 2026 00:00:00 GMT NTDS.dit is the Active Directory database on a domain controller and contains credential-derived material for domain accounts. https://welbournesecurity.com/blue-team/learn/artefacts/ot-engineering-workstation-project-archives/ https://welbournesecurity.com/blue-team/learn/artefacts/ot-engineering-workstation-project-archives/#Learn: OT engineering-workstation project archives Wed, 15 Jul 2026 00:00:00 GMT OT engineering-workstation project archives can expose controller projects, tag databases, network layouts and device credentials used for industrial engineering. https://welbournesecurity.com/blue-team/learn/artefacts/package-registry-credentials/ https://welbournesecurity.com/blue-team/learn/artefacts/package-registry-credentials/#Learn: Package registry credentials Wed, 15 Jul 2026 00:00:00 GMT Package registry credentials can expose tokens and credentials used to publish or retrieve software packages. https://welbournesecurity.com/blue-team/learn/artefacts/password-manager-vaults/ https://welbournesecurity.com/blue-team/learn/artefacts/password-manager-vaults/#Learn: Password manager vaults Wed, 15 Jul 2026 00:00:00 GMT Password manager vaults can expose concentrated personal and enterprise credentials. https://welbournesecurity.com/blue-team/learn/artefacts/plc-programs-and-logic-backups/ https://welbournesecurity.com/blue-team/learn/artefacts/plc-programs-and-logic-backups/#Learn: PLC programs and logic backups Wed, 15 Jul 2026 00:00:00 GMT PLC programs and logic backups can expose approved control logic, tags, hardware configuration and process intent. https://welbournesecurity.com/blue-team/learn/artefacts/process-memory-and-proc-environment-data/ https://welbournesecurity.com/blue-team/learn/artefacts/process-memory-and-proc-environment-data/#Learn: Process memory and /proc environment data Wed, 15 Jul 2026 00:00:00 GMT Process memory and /proc environment data can expose runtime tokens, credentials and environment secrets. https://welbournesecurity.com/blue-team/learn/artefacts/pst-ost-and-mbox-email-stores/ https://welbournesecurity.com/blue-team/learn/artefacts/pst-ost-and-mbox-email-stores/#Learn: PST, OST and MBOX email stores Wed, 15 Jul 2026 00:00:00 GMT PST, OST and MBOX email stores can expose cached or exported email, attachments, contacts and mailbox metadata. https://welbournesecurity.com/blue-team/learn/artefacts/sam-hive/ https://welbournesecurity.com/blue-team/learn/artefacts/sam-hive/#Learn: SAM hive Wed, 15 Jul 2026 00:00:00 GMT SAM hive can expose local account password hashes and account metadata. https://welbournesecurity.com/blue-team/learn/artefacts/saml-oidc-signing-keys-and-federation-certificates/ https://welbournesecurity.com/blue-team/learn/artefacts/saml-oidc-signing-keys-and-federation-certificates/#Learn: SAML/OIDC signing keys and federation certificates Wed, 15 Jul 2026 00:00:00 GMT SAML/OIDC signing keys and federation certificates can expose keys that establish trust for federated identity assertions. https://welbournesecurity.com/blue-team/learn/artefacts/saved-rdp-credentials/ https://welbournesecurity.com/blue-team/learn/artefacts/saved-rdp-credentials/#Learn: Saved RDP credentials Wed, 15 Jul 2026 00:00:00 GMT Saved RDP credentials can expose credentials and target history for remote desktop access. https://welbournesecurity.com/blue-team/learn/artefacts/security-hive-and-lsa-secrets/ https://welbournesecurity.com/blue-team/learn/artefacts/security-hive-and-lsa-secrets/#Learn: SECURITY hive and LSA secrets Wed, 15 Jul 2026 00:00:00 GMT SECURITY hive and LSA secrets can expose service credentials, cached secrets and LSA-protected material. https://welbournesecurity.com/blue-team/learn/artefacts/shell-history/ https://welbournesecurity.com/blue-team/learn/artefacts/shell-history/#Learn: Shell history Wed, 15 Jul 2026 00:00:00 GMT Shell history can expose commands that may expose credentials, targets and administrative actions. https://welbournesecurity.com/blue-team/learn/artefacts/source-repositories-containing-secrets/ https://welbournesecurity.com/blue-team/learn/artefacts/source-repositories-containing-secrets/#Learn: Source repositories containing secrets Wed, 15 Jul 2026 00:00:00 GMT Source repositories containing secrets can expose credentials, endpoints, signing keys and deployment history. https://welbournesecurity.com/blue-team/learn/artefacts/ssh-agent-sockets-and-forwarded-identities/ https://welbournesecurity.com/blue-team/learn/artefacts/ssh-agent-sockets-and-forwarded-identities/#Learn: SSH agent sockets and forwarded identities Wed, 15 Jul 2026 00:00:00 GMT SSH agent sockets and forwarded identities can expose live access to signing operations performed by keys held in an SSH agent. https://welbournesecurity.com/blue-team/learn/artefacts/ssh-private-keys/ https://welbournesecurity.com/blue-team/learn/artefacts/ssh-private-keys/#Learn: SSH private keys Wed, 15 Jul 2026 00:00:00 GMT SSH private keys can expose private keys that authenticate users and services. https://welbournesecurity.com/blue-team/learn/artefacts/system-hive-and-boot-key-material/ https://welbournesecurity.com/blue-team/learn/artefacts/system-hive-and-boot-key-material/#Learn: SYSTEM hive and boot key material Wed, 15 Jul 2026 00:00:00 GMT SYSTEM hive and boot key material can expose system configuration and key material needed to protect other Windows stores. https://welbournesecurity.com/blue-team/learn/artefacts/system-state-and-directory-backups/ https://welbournesecurity.com/blue-team/learn/artefacts/system-state-and-directory-backups/#Learn: System-state and directory backups Wed, 15 Jul 2026 00:00:00 GMT System-state and directory backups can expose recoverable identity databases, registry state and keys. https://welbournesecurity.com/blue-team/learn/artefacts/terraform-state-files/ https://welbournesecurity.com/blue-team/learn/artefacts/terraform-state-files/#Learn: Terraform state files Wed, 15 Jul 2026 00:00:00 GMT Terraform state files can expose deployed infrastructure values, resource identifiers and sometimes provider or application secrets. https://welbournesecurity.com/blue-team/learn/artefacts/unattended-installation-and-sysprep-files/ https://welbournesecurity.com/blue-team/learn/artefacts/unattended-installation-and-sysprep-files/#Learn: Unattended installation and Sysprep files Wed, 15 Jul 2026 00:00:00 GMT Unattended installation and Sysprep files can expose deployment credentials, product configuration and joining secrets. https://welbournesecurity.com/blue-team/learn/artefacts/vault-tokens-and-response-wrapping-tokens/ https://welbournesecurity.com/blue-team/learn/artefacts/vault-tokens-and-response-wrapping-tokens/#Learn: Vault tokens and response-wrapping tokens Wed, 15 Jul 2026 00:00:00 GMT Vault tokens and response-wrapping tokens can expose bearer material that authorises Vault API operations or unwraps a protected response. https://welbournesecurity.com/blue-team/learn/artefacts/vm-snapshots-and-disk-images/ https://welbournesecurity.com/blue-team/learn/artefacts/vm-snapshots-and-disk-images/#Learn: VM snapshots and disk images Wed, 15 Jul 2026 00:00:00 GMT VM snapshots and disk images can expose complete machine state including files, memory and configuration. https://welbournesecurity.com/blue-team/learn/artefacts/vpn-profiles-client-certificates-and-recovery-material/ https://welbournesecurity.com/blue-team/learn/artefacts/vpn-profiles-client-certificates-and-recovery-material/#Learn: VPN profiles, client certificates and recovery material Wed, 15 Jul 2026 00:00:00 GMT VPN profiles, client certificates and recovery material can expose connection details and authentication material used to enter protected networks. https://welbournesecurity.com/blue-team/learn/artefacts/wi-fi-profiles/ https://welbournesecurity.com/blue-team/learn/artefacts/wi-fi-profiles/#Learn: Wi-Fi profiles Wed, 15 Jul 2026 00:00:00 GMT Wi-Fi profiles can expose wireless network names, settings and sometimes recoverable keys. https://welbournesecurity.com/blue-team/learn/artefacts/windows-credential-manager-and-vault/ https://welbournesecurity.com/blue-team/learn/artefacts/windows-credential-manager-and-vault/#Learn: Windows Credential Manager and Vault Wed, 15 Jul 2026 00:00:00 GMT Windows Credential Manager and Vault can expose saved application, network and web credentials. https://welbournesecurity.com/blue-team/learn/ports/20/ https://welbournesecurity.com/blue-team/learn/ports/20/#Learn: Port 20: FTP Wed, 15 Jul 2026 00:00:00 GMT Port 20 is commonly associated with FTP. https://welbournesecurity.com/blue-team/learn/ports/21/ https://welbournesecurity.com/blue-team/learn/ports/21/#Learn: Port 21: FTP Wed, 15 Jul 2026 00:00:00 GMT Port 21 is commonly associated with FTP. https://welbournesecurity.com/blue-team/learn/ports/22/ https://welbournesecurity.com/blue-team/learn/ports/22/#Learn: Port 22: SSH Wed, 15 Jul 2026 00:00:00 GMT Port 22 is commonly associated with SSH. https://welbournesecurity.com/blue-team/learn/ports/23/ https://welbournesecurity.com/blue-team/learn/ports/23/#Learn: Port 23: Telnet Wed, 15 Jul 2026 00:00:00 GMT Port 23 is commonly associated with Telnet. https://welbournesecurity.com/blue-team/learn/ports/25/ https://welbournesecurity.com/blue-team/learn/ports/25/#Learn: Port 25: SMTP Wed, 15 Jul 2026 00:00:00 GMT Port 25 is commonly associated with SMTP. https://welbournesecurity.com/blue-team/learn/ports/49/ https://welbournesecurity.com/blue-team/learn/ports/49/#Learn: Port 49: TACACS+ Wed, 15 Jul 2026 00:00:00 GMT Port 49 is commonly associated with TACACS+. https://welbournesecurity.com/blue-team/learn/ports/53/ https://welbournesecurity.com/blue-team/learn/ports/53/#Learn: Port 53: DNS Wed, 15 Jul 2026 00:00:00 GMT Port 53 is commonly associated with DNS. https://welbournesecurity.com/blue-team/learn/ports/67/ https://welbournesecurity.com/blue-team/learn/ports/67/#Learn: Port 67: DHCP Wed, 15 Jul 2026 00:00:00 GMT Port 67 is commonly associated with DHCP. https://welbournesecurity.com/blue-team/learn/ports/68/ https://welbournesecurity.com/blue-team/learn/ports/68/#Learn: Port 68: DHCP Wed, 15 Jul 2026 00:00:00 GMT Port 68 is commonly associated with DHCP. https://welbournesecurity.com/blue-team/learn/ports/69/ https://welbournesecurity.com/blue-team/learn/ports/69/#Learn: Port 69: TFTP Wed, 15 Jul 2026 00:00:00 GMT Port 69 is commonly associated with TFTP. https://welbournesecurity.com/blue-team/learn/ports/80/ https://welbournesecurity.com/blue-team/learn/ports/80/#Learn: Port 80: HTTP Wed, 15 Jul 2026 00:00:00 GMT Port 80 is commonly associated with HTTP. https://welbournesecurity.com/blue-team/learn/ports/88/ https://welbournesecurity.com/blue-team/learn/ports/88/#Learn: Port 88: Kerberos Wed, 15 Jul 2026 00:00:00 GMT Port 88 is commonly associated with Kerberos. https://welbournesecurity.com/blue-team/learn/ports/102/ https://welbournesecurity.com/blue-team/learn/ports/102/#Learn: Port 102: Siemens S7comm Wed, 15 Jul 2026 00:00:00 GMT Port 102 is commonly associated with Siemens S7comm. https://welbournesecurity.com/blue-team/learn/ports/110/ https://welbournesecurity.com/blue-team/learn/ports/110/#Learn: Port 110: POP3 Wed, 15 Jul 2026 00:00:00 GMT Port 110 is commonly associated with POP3. https://welbournesecurity.com/blue-team/learn/ports/111/ https://welbournesecurity.com/blue-team/learn/ports/111/#Learn: Port 111: rpcbind Wed, 15 Jul 2026 00:00:00 GMT Port 111 is commonly associated with rpcbind. https://welbournesecurity.com/blue-team/learn/ports/123/ https://welbournesecurity.com/blue-team/learn/ports/123/#Learn: Port 123: NTP Wed, 15 Jul 2026 00:00:00 GMT Port 123 is commonly associated with NTP. https://welbournesecurity.com/blue-team/learn/ports/135/ https://welbournesecurity.com/blue-team/learn/ports/135/#Learn: Port 135: RPC/DCOM Endpoint Mapper Wed, 15 Jul 2026 00:00:00 GMT Port 135 is commonly associated with RPC/DCOM Endpoint Mapper. https://welbournesecurity.com/blue-team/learn/ports/137/ https://welbournesecurity.com/blue-team/learn/ports/137/#Learn: Port 137: NetBIOS Wed, 15 Jul 2026 00:00:00 GMT Port 137 is commonly associated with NetBIOS. https://welbournesecurity.com/blue-team/learn/ports/138/ https://welbournesecurity.com/blue-team/learn/ports/138/#Learn: Port 138: NetBIOS Wed, 15 Jul 2026 00:00:00 GMT Port 138 is commonly associated with NetBIOS. https://welbournesecurity.com/blue-team/learn/ports/139/ https://welbournesecurity.com/blue-team/learn/ports/139/#Learn: Port 139: NetBIOS Wed, 15 Jul 2026 00:00:00 GMT Port 139 is commonly associated with NetBIOS. https://welbournesecurity.com/blue-team/learn/ports/143/ https://welbournesecurity.com/blue-team/learn/ports/143/#Learn: Port 143: IMAP Wed, 15 Jul 2026 00:00:00 GMT Port 143 is commonly associated with IMAP. https://welbournesecurity.com/blue-team/learn/ports/161/ https://welbournesecurity.com/blue-team/learn/ports/161/#Learn: Port 161: SNMP Wed, 15 Jul 2026 00:00:00 GMT Port 161 is commonly associated with SNMP. https://welbournesecurity.com/blue-team/learn/ports/162/ https://welbournesecurity.com/blue-team/learn/ports/162/#Learn: Port 162: SNMP Wed, 15 Jul 2026 00:00:00 GMT Port 162 is commonly associated with SNMP. https://welbournesecurity.com/blue-team/learn/ports/179/ https://welbournesecurity.com/blue-team/learn/ports/179/#Learn: Port 179: BGP Wed, 15 Jul 2026 00:00:00 GMT Port 179 is commonly associated with BGP. https://welbournesecurity.com/blue-team/learn/ports/389/ https://welbournesecurity.com/blue-team/learn/ports/389/#Learn: Port 389: LDAP Wed, 15 Jul 2026 00:00:00 GMT Port 389 is commonly associated with LDAP. https://welbournesecurity.com/blue-team/learn/ports/443/ https://welbournesecurity.com/blue-team/learn/ports/443/#Learn: Port 443: HTTPS/TLS, Encrypted DNS Wed, 15 Jul 2026 00:00:00 GMT Port 443 is commonly associated with HTTPS/TLS, Encrypted DNS. https://welbournesecurity.com/blue-team/learn/ports/445/ https://welbournesecurity.com/blue-team/learn/ports/445/#Learn: Port 445: SMB Wed, 15 Jul 2026 00:00:00 GMT Port 445 is commonly associated with SMB. https://welbournesecurity.com/blue-team/learn/ports/464/ https://welbournesecurity.com/blue-team/learn/ports/464/#Learn: Port 464: Kerberos Wed, 15 Jul 2026 00:00:00 GMT Port 464 is commonly associated with Kerberos. https://welbournesecurity.com/blue-team/learn/ports/465/ https://welbournesecurity.com/blue-team/learn/ports/465/#Learn: Port 465: SMTP Wed, 15 Jul 2026 00:00:00 GMT Port 465 is commonly associated with SMTP. https://welbournesecurity.com/blue-team/learn/ports/500/ https://welbournesecurity.com/blue-team/learn/ports/500/#Learn: Port 500: IKE/IPsec Wed, 15 Jul 2026 00:00:00 GMT Port 500 is commonly associated with IKE/IPsec. https://welbournesecurity.com/blue-team/learn/ports/502/ https://welbournesecurity.com/blue-team/learn/ports/502/#Learn: Port 502: Modbus/TCP Wed, 15 Jul 2026 00:00:00 GMT Port 502 is commonly associated with Modbus/TCP. https://welbournesecurity.com/blue-team/learn/ports/514/ https://welbournesecurity.com/blue-team/learn/ports/514/#Learn: Port 514: Syslog Wed, 15 Jul 2026 00:00:00 GMT Port 514 is commonly associated with Syslog. https://welbournesecurity.com/blue-team/learn/ports/546/ https://welbournesecurity.com/blue-team/learn/ports/546/#Learn: Port 546: DHCP Wed, 15 Jul 2026 00:00:00 GMT Port 546 is commonly associated with DHCP. https://welbournesecurity.com/blue-team/learn/ports/547/ https://welbournesecurity.com/blue-team/learn/ports/547/#Learn: Port 547: DHCP Wed, 15 Jul 2026 00:00:00 GMT Port 547 is commonly associated with DHCP. https://welbournesecurity.com/blue-team/learn/ports/587/ https://welbournesecurity.com/blue-team/learn/ports/587/#Learn: Port 587: SMTP Wed, 15 Jul 2026 00:00:00 GMT Port 587 is commonly associated with SMTP. https://welbournesecurity.com/blue-team/learn/ports/623/ https://welbournesecurity.com/blue-team/learn/ports/623/#Learn: Port 623: IPMI/RMCP Wed, 15 Jul 2026 00:00:00 GMT Port 623 is associated with IPMI/RMCP in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/636/ https://welbournesecurity.com/blue-team/learn/ports/636/#Learn: Port 636: LDAP Wed, 15 Jul 2026 00:00:00 GMT Port 636 is commonly associated with LDAP. https://welbournesecurity.com/blue-team/learn/ports/853/ https://welbournesecurity.com/blue-team/learn/ports/853/#Learn: Port 853: Encrypted DNS Wed, 15 Jul 2026 00:00:00 GMT Port 853 is commonly associated with Encrypted DNS. https://welbournesecurity.com/blue-team/learn/ports/873/ https://welbournesecurity.com/blue-team/learn/ports/873/#Learn: Port 873: rsync Wed, 15 Jul 2026 00:00:00 GMT Port 873 is commonly associated with rsync. https://welbournesecurity.com/blue-team/learn/ports/989/ https://welbournesecurity.com/blue-team/learn/ports/989/#Learn: Port 989: FTPS Wed, 15 Jul 2026 00:00:00 GMT Port 989 is commonly associated with FTPS. https://welbournesecurity.com/blue-team/learn/ports/990/ https://welbournesecurity.com/blue-team/learn/ports/990/#Learn: Port 990: FTPS Wed, 15 Jul 2026 00:00:00 GMT Port 990 is commonly associated with FTPS. https://welbournesecurity.com/blue-team/learn/ports/993/ https://welbournesecurity.com/blue-team/learn/ports/993/#Learn: Port 993: IMAP Wed, 15 Jul 2026 00:00:00 GMT Port 993 is commonly associated with IMAP. https://welbournesecurity.com/blue-team/learn/ports/995/ https://welbournesecurity.com/blue-team/learn/ports/995/#Learn: Port 995: POP3 Wed, 15 Jul 2026 00:00:00 GMT Port 995 is commonly associated with POP3. https://welbournesecurity.com/blue-team/learn/ports/1194/ https://welbournesecurity.com/blue-team/learn/ports/1194/#Learn: Port 1194: OpenVPN Wed, 15 Jul 2026 00:00:00 GMT Port 1194 is commonly associated with OpenVPN. https://welbournesecurity.com/blue-team/learn/ports/1433/ https://welbournesecurity.com/blue-team/learn/ports/1433/#Learn: Port 1433: Microsoft SQL Server Wed, 15 Jul 2026 00:00:00 GMT Port 1433 is commonly associated with Microsoft SQL Server. https://welbournesecurity.com/blue-team/learn/ports/1434/ https://welbournesecurity.com/blue-team/learn/ports/1434/#Learn: Port 1434: Microsoft SQL Server Wed, 15 Jul 2026 00:00:00 GMT Port 1434 is commonly associated with Microsoft SQL Server. https://welbournesecurity.com/blue-team/learn/ports/1521/ https://welbournesecurity.com/blue-team/learn/ports/1521/#Learn: Port 1521: Oracle Net Wed, 15 Jul 2026 00:00:00 GMT Port 1521 is commonly associated with Oracle Net. https://welbournesecurity.com/blue-team/learn/ports/1645/ https://welbournesecurity.com/blue-team/learn/ports/1645/#Learn: Port 1645: RADIUS Wed, 15 Jul 2026 00:00:00 GMT Port 1645 is commonly associated with RADIUS. https://welbournesecurity.com/blue-team/learn/ports/1646/ https://welbournesecurity.com/blue-team/learn/ports/1646/#Learn: Port 1646: RADIUS Wed, 15 Jul 2026 00:00:00 GMT Port 1646 is commonly associated with RADIUS. https://welbournesecurity.com/blue-team/learn/ports/1812/ https://welbournesecurity.com/blue-team/learn/ports/1812/#Learn: Port 1812: RADIUS Wed, 15 Jul 2026 00:00:00 GMT Port 1812 is commonly associated with RADIUS. https://welbournesecurity.com/blue-team/learn/ports/1813/ https://welbournesecurity.com/blue-team/learn/ports/1813/#Learn: Port 1813: RADIUS Wed, 15 Jul 2026 00:00:00 GMT Port 1813 is commonly associated with RADIUS. https://welbournesecurity.com/blue-team/learn/ports/1883/ https://welbournesecurity.com/blue-team/learn/ports/1883/#Learn: Port 1883: MQTT Wed, 15 Jul 2026 00:00:00 GMT Port 1883 is commonly associated with MQTT. https://welbournesecurity.com/blue-team/learn/ports/2049/ https://welbournesecurity.com/blue-team/learn/ports/2049/#Learn: Port 2049: NFS Wed, 15 Jul 2026 00:00:00 GMT Port 2049 is commonly associated with NFS. https://welbournesecurity.com/blue-team/learn/ports/2181/ https://welbournesecurity.com/blue-team/learn/ports/2181/#Learn: Port 2181: Apache ZooKeeper client Wed, 15 Jul 2026 00:00:00 GMT Port 2181 is associated with Apache ZooKeeper client in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/2222/ https://welbournesecurity.com/blue-team/learn/ports/2222/#Learn: Port 2222: EtherNet/IP Wed, 15 Jul 2026 00:00:00 GMT Port 2222 is commonly associated with EtherNet/IP. https://welbournesecurity.com/blue-team/learn/ports/2375/ https://welbournesecurity.com/blue-team/learn/ports/2375/#Learn: Port 2375: Docker Engine API Wed, 15 Jul 2026 00:00:00 GMT Port 2375 is commonly associated with Docker Engine API. https://welbournesecurity.com/blue-team/learn/ports/2376/ https://welbournesecurity.com/blue-team/learn/ports/2376/#Learn: Port 2376: Docker Engine API Wed, 15 Jul 2026 00:00:00 GMT Port 2376 is commonly associated with Docker Engine API. https://welbournesecurity.com/blue-team/learn/ports/2377/ https://welbournesecurity.com/blue-team/learn/ports/2377/#Learn: Port 2377: Docker Swarm management Wed, 15 Jul 2026 00:00:00 GMT Port 2377 is associated with Docker Swarm management in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/2379/ https://welbournesecurity.com/blue-team/learn/ports/2379/#Learn: Port 2379: etcd Wed, 15 Jul 2026 00:00:00 GMT Port 2379 is commonly associated with etcd. https://welbournesecurity.com/blue-team/learn/ports/2380/ https://welbournesecurity.com/blue-team/learn/ports/2380/#Learn: Port 2380: etcd Wed, 15 Jul 2026 00:00:00 GMT Port 2380 is commonly associated with etcd. https://welbournesecurity.com/blue-team/learn/ports/2404/ https://welbournesecurity.com/blue-team/learn/ports/2404/#Learn: Port 2404: IEC 60870-5-104 Wed, 15 Jul 2026 00:00:00 GMT Port 2404 is commonly associated with IEC 60870-5-104. https://welbournesecurity.com/blue-team/learn/ports/2888/ https://welbournesecurity.com/blue-team/learn/ports/2888/#Learn: Port 2888: Apache ZooKeeper quorum Wed, 15 Jul 2026 00:00:00 GMT Port 2888 is associated with Apache ZooKeeper quorum in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/3128/ https://welbournesecurity.com/blue-team/learn/ports/3128/#Learn: Port 3128: HTTP proxy Wed, 15 Jul 2026 00:00:00 GMT Port 3128 is commonly associated with HTTP proxy. https://welbournesecurity.com/blue-team/learn/ports/3260/ https://welbournesecurity.com/blue-team/learn/ports/3260/#Learn: Port 3260: iSCSI Wed, 15 Jul 2026 00:00:00 GMT Port 3260 is commonly associated with iSCSI. https://welbournesecurity.com/blue-team/learn/ports/3268/ https://welbournesecurity.com/blue-team/learn/ports/3268/#Learn: Port 3268: Global Catalog Wed, 15 Jul 2026 00:00:00 GMT Port 3268 is commonly associated with Global Catalog. https://welbournesecurity.com/blue-team/learn/ports/3269/ https://welbournesecurity.com/blue-team/learn/ports/3269/#Learn: Port 3269: Global Catalog Wed, 15 Jul 2026 00:00:00 GMT Port 3269 is commonly associated with Global Catalog. https://welbournesecurity.com/blue-team/learn/ports/3306/ https://welbournesecurity.com/blue-team/learn/ports/3306/#Learn: Port 3306: MySQL/MariaDB Wed, 15 Jul 2026 00:00:00 GMT Port 3306 is commonly associated with MySQL/MariaDB. https://welbournesecurity.com/blue-team/learn/ports/3389/ https://welbournesecurity.com/blue-team/learn/ports/3389/#Learn: Port 3389: RDP Wed, 15 Jul 2026 00:00:00 GMT Port 3389 is commonly associated with RDP. https://welbournesecurity.com/blue-team/learn/ports/3888/ https://welbournesecurity.com/blue-team/learn/ports/3888/#Learn: Port 3888: Apache ZooKeeper leader election Wed, 15 Jul 2026 00:00:00 GMT Port 3888 is associated with Apache ZooKeeper leader election in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/4222/ https://welbournesecurity.com/blue-team/learn/ports/4222/#Learn: Port 4222: NATS client Wed, 15 Jul 2026 00:00:00 GMT Port 4222 is associated with NATS client in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/4500/ https://welbournesecurity.com/blue-team/learn/ports/4500/#Learn: Port 4500: IKE/IPsec Wed, 15 Jul 2026 00:00:00 GMT Port 4500 is commonly associated with IKE/IPsec. https://welbournesecurity.com/blue-team/learn/ports/4789/ https://welbournesecurity.com/blue-team/learn/ports/4789/#Learn: Port 4789: VXLAN and Docker overlay traffic Wed, 15 Jul 2026 00:00:00 GMT Port 4789 is associated with VXLAN and Docker overlay traffic in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/4840/ https://welbournesecurity.com/blue-team/learn/ports/4840/#Learn: Port 4840: OPC UA Wed, 15 Jul 2026 00:00:00 GMT Port 4840 is commonly associated with OPC UA. https://welbournesecurity.com/blue-team/learn/ports/5000/ https://welbournesecurity.com/blue-team/learn/ports/5000/#Learn: Port 5000: Docker Registry Wed, 15 Jul 2026 00:00:00 GMT Port 5000 is associated with Docker Registry in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/5060/ https://welbournesecurity.com/blue-team/learn/ports/5060/#Learn: Port 5060: SIP Wed, 15 Jul 2026 00:00:00 GMT Port 5060 is commonly associated with SIP. https://welbournesecurity.com/blue-team/learn/ports/5061/ https://welbournesecurity.com/blue-team/learn/ports/5061/#Learn: Port 5061: SIP Wed, 15 Jul 2026 00:00:00 GMT Port 5061 is commonly associated with SIP. https://welbournesecurity.com/blue-team/learn/ports/5353/ https://welbournesecurity.com/blue-team/learn/ports/5353/#Learn: Port 5353: mDNS Wed, 15 Jul 2026 00:00:00 GMT Port 5353 is commonly associated with mDNS. https://welbournesecurity.com/blue-team/learn/ports/5355/ https://welbournesecurity.com/blue-team/learn/ports/5355/#Learn: Port 5355: LLMNR Wed, 15 Jul 2026 00:00:00 GMT Port 5355 is commonly associated with LLMNR. https://welbournesecurity.com/blue-team/learn/ports/5432/ https://welbournesecurity.com/blue-team/learn/ports/5432/#Learn: Port 5432: PostgreSQL Wed, 15 Jul 2026 00:00:00 GMT Port 5432 is commonly associated with PostgreSQL. https://welbournesecurity.com/blue-team/learn/ports/5671/ https://welbournesecurity.com/blue-team/learn/ports/5671/#Learn: Port 5671: AMQP/RabbitMQ Wed, 15 Jul 2026 00:00:00 GMT Port 5671 is commonly associated with AMQP/RabbitMQ. https://welbournesecurity.com/blue-team/learn/ports/5672/ https://welbournesecurity.com/blue-team/learn/ports/5672/#Learn: Port 5672: AMQP/RabbitMQ Wed, 15 Jul 2026 00:00:00 GMT Port 5672 is commonly associated with AMQP/RabbitMQ. https://welbournesecurity.com/blue-team/learn/ports/5900/ https://welbournesecurity.com/blue-team/learn/ports/5900/#Learn: Port 5900: VNC Wed, 15 Jul 2026 00:00:00 GMT Port 5900 is commonly associated with VNC. https://welbournesecurity.com/blue-team/learn/ports/5985/ https://welbournesecurity.com/blue-team/learn/ports/5985/#Learn: Port 5985: WinRM/WS-Man Wed, 15 Jul 2026 00:00:00 GMT Port 5985 is commonly associated with WinRM/WS-Man. https://welbournesecurity.com/blue-team/learn/ports/5986/ https://welbournesecurity.com/blue-team/learn/ports/5986/#Learn: Port 5986: WinRM/WS-Man Wed, 15 Jul 2026 00:00:00 GMT Port 5986 is commonly associated with WinRM/WS-Man. https://welbournesecurity.com/blue-team/learn/ports/6379/ https://welbournesecurity.com/blue-team/learn/ports/6379/#Learn: Port 6379: Redis Wed, 15 Jul 2026 00:00:00 GMT Port 6379 is commonly associated with Redis. https://welbournesecurity.com/blue-team/learn/ports/6443/ https://welbournesecurity.com/blue-team/learn/ports/6443/#Learn: Port 6443: Kubernetes API Wed, 15 Jul 2026 00:00:00 GMT Port 6443 is commonly associated with Kubernetes API. https://welbournesecurity.com/blue-team/learn/ports/6514/ https://welbournesecurity.com/blue-team/learn/ports/6514/#Learn: Port 6514: Syslog Wed, 15 Jul 2026 00:00:00 GMT Port 6514 is commonly associated with Syslog. https://welbournesecurity.com/blue-team/learn/ports/7946/ https://welbournesecurity.com/blue-team/learn/ports/7946/#Learn: Port 7946: Docker Swarm node communication Wed, 15 Jul 2026 00:00:00 GMT Port 7946 is associated with Docker Swarm node communication in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/8080/ https://welbournesecurity.com/blue-team/learn/ports/8080/#Learn: Port 8080: HTTP, HTTP proxy Wed, 15 Jul 2026 00:00:00 GMT Port 8080 is commonly associated with HTTP, HTTP proxy. https://welbournesecurity.com/blue-team/learn/ports/8200/ https://welbournesecurity.com/blue-team/learn/ports/8200/#Learn: Port 8200: HashiCorp Vault API Wed, 15 Jul 2026 00:00:00 GMT Port 8200 is associated with HashiCorp Vault API in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/8201/ https://welbournesecurity.com/blue-team/learn/ports/8201/#Learn: Port 8201: HashiCorp Vault cluster Wed, 15 Jul 2026 00:00:00 GMT Port 8201 is associated with HashiCorp Vault cluster in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/8300/ https://welbournesecurity.com/blue-team/learn/ports/8300/#Learn: Port 8300: Consul server RPC Wed, 15 Jul 2026 00:00:00 GMT Port 8300 is associated with Consul server RPC in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/8301/ https://welbournesecurity.com/blue-team/learn/ports/8301/#Learn: Port 8301: Consul LAN gossip Wed, 15 Jul 2026 00:00:00 GMT Port 8301 is associated with Consul LAN gossip in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/8302/ https://welbournesecurity.com/blue-team/learn/ports/8302/#Learn: Port 8302: Consul WAN gossip Wed, 15 Jul 2026 00:00:00 GMT Port 8302 is associated with Consul WAN gossip in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/8500/ https://welbournesecurity.com/blue-team/learn/ports/8500/#Learn: Port 8500: Consul HTTP API Wed, 15 Jul 2026 00:00:00 GMT Port 8500 is associated with Consul HTTP API in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/8600/ https://welbournesecurity.com/blue-team/learn/ports/8600/#Learn: Port 8600: Consul DNS Wed, 15 Jul 2026 00:00:00 GMT Port 8600 is associated with Consul DNS in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/8883/ https://welbournesecurity.com/blue-team/learn/ports/8883/#Learn: Port 8883: MQTT Wed, 15 Jul 2026 00:00:00 GMT Port 8883 is commonly associated with MQTT. https://welbournesecurity.com/blue-team/learn/ports/9042/ https://welbournesecurity.com/blue-team/learn/ports/9042/#Learn: Port 9042: Apache Cassandra CQL Wed, 15 Jul 2026 00:00:00 GMT Port 9042 is associated with Apache Cassandra CQL in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/9090/ https://welbournesecurity.com/blue-team/learn/ports/9090/#Learn: Port 9090: Prometheus Wed, 15 Jul 2026 00:00:00 GMT Port 9090 is associated with Prometheus in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/9092/ https://welbournesecurity.com/blue-team/learn/ports/9092/#Learn: Port 9092: Apache Kafka broker Wed, 15 Jul 2026 00:00:00 GMT Port 9092 is associated with Apache Kafka broker in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/9200/ https://welbournesecurity.com/blue-team/learn/ports/9200/#Learn: Port 9200: Elasticsearch Wed, 15 Jul 2026 00:00:00 GMT Port 9200 is commonly associated with Elasticsearch. https://welbournesecurity.com/blue-team/learn/ports/9300/ https://welbournesecurity.com/blue-team/learn/ports/9300/#Learn: Port 9300: Elasticsearch Wed, 15 Jul 2026 00:00:00 GMT Port 9300 is commonly associated with Elasticsearch. https://welbournesecurity.com/blue-team/learn/ports/9389/ https://welbournesecurity.com/blue-team/learn/ports/9389/#Learn: Port 9389: Active Directory Web Services Wed, 15 Jul 2026 00:00:00 GMT Port 9389 is commonly associated with Active Directory Web Services. https://welbournesecurity.com/blue-team/learn/ports/9418/ https://welbournesecurity.com/blue-team/learn/ports/9418/#Learn: Port 9418: Git protocol Wed, 15 Jul 2026 00:00:00 GMT Port 9418 is commonly associated with Git protocol. https://welbournesecurity.com/blue-team/learn/ports/10250/ https://welbournesecurity.com/blue-team/learn/ports/10250/#Learn: Port 10250: kubelet Wed, 15 Jul 2026 00:00:00 GMT Port 10250 is commonly associated with kubelet. https://welbournesecurity.com/blue-team/learn/ports/10256/ https://welbournesecurity.com/blue-team/learn/ports/10256/#Learn: Port 10256: Kubernetes kube-proxy Wed, 15 Jul 2026 00:00:00 GMT Port 10256 is associated with Kubernetes kube-proxy in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/10257/ https://welbournesecurity.com/blue-team/learn/ports/10257/#Learn: Port 10257: Kubernetes controller manager Wed, 15 Jul 2026 00:00:00 GMT Port 10257 is associated with Kubernetes controller manager in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/10259/ https://welbournesecurity.com/blue-team/learn/ports/10259/#Learn: Port 10259: Kubernetes scheduler Wed, 15 Jul 2026 00:00:00 GMT Port 10259 is associated with Kubernetes scheduler in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/11211/ https://welbournesecurity.com/blue-team/learn/ports/11211/#Learn: Port 11211: Memcached Wed, 15 Jul 2026 00:00:00 GMT Port 11211 is associated with Memcached in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/15672/ https://welbournesecurity.com/blue-team/learn/ports/15672/#Learn: Port 15672: AMQP/RabbitMQ Wed, 15 Jul 2026 00:00:00 GMT Port 15672 is commonly associated with AMQP/RabbitMQ. https://welbournesecurity.com/blue-team/learn/ports/20000/ https://welbournesecurity.com/blue-team/learn/ports/20000/#Learn: Port 20000: DNP3 Wed, 15 Jul 2026 00:00:00 GMT Port 20000 is commonly associated with DNP3. https://welbournesecurity.com/blue-team/learn/ports/27017/ https://welbournesecurity.com/blue-team/learn/ports/27017/#Learn: Port 27017: MongoDB Wed, 15 Jul 2026 00:00:00 GMT Port 27017 is commonly associated with MongoDB. https://welbournesecurity.com/blue-team/learn/ports/30000-32767/ https://welbournesecurity.com/blue-team/learn/ports/30000-32767/#Learn: Port 30000-32767: Kubernetes NodePort services Wed, 15 Jul 2026 00:00:00 GMT Port 30000-32767 is associated with Kubernetes NodePort services in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/34962-34964/ https://welbournesecurity.com/blue-team/learn/ports/34962-34964/#Learn: Port 34962-34964: PROFINET Wed, 15 Jul 2026 00:00:00 GMT Port 34962-34964 is associated with PROFINET in the documented deployment model. https://welbournesecurity.com/blue-team/learn/ports/44818/ https://welbournesecurity.com/blue-team/learn/ports/44818/#Learn: Port 44818: EtherNet/IP Wed, 15 Jul 2026 00:00:00 GMT Port 44818 is commonly associated with EtherNet/IP. https://welbournesecurity.com/blue-team/learn/ports/47808/ https://welbournesecurity.com/blue-team/learn/ports/47808/#Learn: Port 47808: BACnet/IP Wed, 15 Jul 2026 00:00:00 GMT Port 47808 is commonly associated with BACnet/IP. https://welbournesecurity.com/blue-team/learn/ports/49152-65535/ https://welbournesecurity.com/blue-team/learn/ports/49152-65535/#Learn: Port 49152-65535: RPC/DCOM Endpoint Mapper Wed, 15 Jul 2026 00:00:00 GMT Port 49152-65535 is commonly associated with RPC/DCOM Endpoint Mapper. https://welbournesecurity.com/blue-team/learn/ports/51820/ https://welbournesecurity.com/blue-team/learn/ports/51820/#Learn: Port 51820: WireGuard Wed, 15 Jul 2026 00:00:00 GMT Port 51820 is commonly associated with WireGuard. https://welbournesecurity.com/blue-team/learn/collections/active-directory-and-windows-identity/ https://welbournesecurity.com/blue-team/learn/collections/active-directory-and-windows-identity/#Learn collection: Active Directory and Windows Identity Wed, 15 Jul 2026 00:00:00 GMT Understand the services, credential stores and attack paths that shape Windows enterprise identity. https://welbournesecurity.com/blue-team/learn/collections/endpoint-and-dfir/ https://welbournesecurity.com/blue-team/learn/collections/endpoint-and-dfir/#Learn collection: Endpoint and DFIR Wed, 15 Jul 2026 00:00:00 GMT Connect endpoint behaviour, valuable local artefacts and investigation evidence across Windows, Linux and macOS. https://welbournesecurity.com/blue-team/learn/collections/network-and-remote-access/ https://welbournesecurity.com/blue-team/learn/collections/network-and-remote-access/#Learn collection: Network and Remote Access Wed, 15 Jul 2026 00:00:00 GMT Move from ports and protocols to the identities, devices and attacks visible across network boundaries. https://welbournesecurity.com/blue-team/learn/collections/web-and-api-security/ https://welbournesecurity.com/blue-team/learn/collections/web-and-api-security/#Learn collection: Web and API Security Wed, 15 Jul 2026 00:00:00 GMT Follow web requests, identity tokens and application flaws from normal service behaviour to defensive evidence. https://welbournesecurity.com/blue-team/learn/collections/cloud-identity-and-workloads/ https://welbournesecurity.com/blue-team/learn/collections/cloud-identity-and-workloads/#Learn collection: Cloud Identity and Workloads Wed, 15 Jul 2026 00:00:00 GMT Understand cloud control planes, workload identities, metadata services and the credentials attackers seek. https://welbournesecurity.com/blue-team/learn/collections/containers-and-kubernetes/ https://welbournesecurity.com/blue-team/learn/collections/containers-and-kubernetes/#Learn collection: Containers and Kubernetes Wed, 15 Jul 2026 00:00:00 GMT Connect cluster services, runtime trust, orchestration attacks and high-value container credentials. https://welbournesecurity.com/blue-team/learn/collections/linux-and-macos/ https://welbournesecurity.com/blue-team/learn/collections/linux-and-macos/#Learn collection: Linux and macOS Wed, 15 Jul 2026 00:00:00 GMT Study Unix-like remote access, persistence, credential stores and investigation evidence. https://welbournesecurity.com/blue-team/learn/collections/ot-and-ics/ https://welbournesecurity.com/blue-team/learn/collections/ot-and-ics/#Learn collection: OT and ICS Wed, 15 Jul 2026 00:00:00 GMT Understand industrial protocols, engineering trust and attacks that can affect a physical process. https://welbournesecurity.com/blue-team/tool-hunting/cobalt-strike/ https://welbournesecurity.com/blue-team/tool-hunting/cobalt-strike/#Tool Hunting: Hunting Cobalt Strike Wed, 15 Jul 2026 00:00:00 GMT A practical analyst guide for turning Beacon configuration, packet captures and process memory into a defensible C2 investigation. https://welbournesecurity.com/blue-team/fundamentals/browser-request/ https://welbournesecurity.com/blue-team/fundamentals/browser-request/#Fundamentals: From URL to Pixels Wed, 15 Jul 2026 00:00:00 GMT Follow a browser navigation from the address bar through name resolution, network transport, web infrastructure and the rendering pipeline. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/#Fundamentals: From Power Button to Desktop Wed, 15 Jul 2026 00:00:00 GMT Follow electrical reset, firmware, trusted boot, kernel start, network readiness and Windows sign-in until Explorer owns the interactive desktop. https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/ https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/#Fundamentals: From Wi-Fi to VPN Wed, 15 Jul 2026 00:00:00 GMT Follow a Windows device from radio discovery and Wi-Fi authentication through IP configuration, VPN policy, tunnel keys and protected application traffic. https://welbournesecurity.com/blue-team/fundamentals/email-delivery/ https://welbournesecurity.com/blue-team/fundamentals/email-delivery/#Fundamentals: From Send to Inbox Wed, 15 Jul 2026 00:00:00 GMT Follow a message from the compose window through MIME construction, authenticated submission, DNS routing, filtering, mailbox storage and recipient synchronisation. https://welbournesecurity.com/blue-team/fundamentals/network-file-access/ https://welbournesecurity.com/blue-team/fundamentals/network-file-access/#Fundamentals: From Network Path to Open File Wed, 15 Jul 2026 00:00:00 GMT Follow a UNC path through the Windows redirector, name resolution, SMB negotiation, authentication, authorisation, caching and file I/O. https://welbournesecurity.com/blue-team/fundamentals/browser-request/url-navigation/ https://welbournesecurity.com/blue-team/fundamentals/browser-request/url-navigation/#Fundamentals: URL input and navigation Wed, 15 Jul 2026 00:00:00 GMT See how the browser interprets address-bar input, parses a URL and starts a cross-document navigation. https://welbournesecurity.com/blue-team/fundamentals/browser-request/browser-state-and-policy/ https://welbournesecurity.com/blue-team/fundamentals/browser-request/browser-state-and-policy/#Fundamentals: Browser state, cache and policy Wed, 15 Jul 2026 00:00:00 GMT Understand the local decisions that can satisfy, alter or stop a request before a new network connection exists. https://welbournesecurity.com/blue-team/fundamentals/browser-request/dns-resolution/ https://welbournesecurity.com/blue-team/fundamentals/browser-request/dns-resolution/#Fundamentals: DNS resolution in the browser Wed, 15 Jul 2026 00:00:00 GMT Trace a hostname through local caches, resolvers, recursive queries and authoritative answers without assuming every lookup uses port 53. https://welbournesecurity.com/blue-team/fundamentals/browser-request/local-network-and-encapsulation/ https://welbournesecurity.com/blue-team/fundamentals/browser-request/local-network-and-encapsulation/#Fundamentals: Local network and encapsulation Wed, 15 Jul 2026 00:00:00 GMT Follow an IP packet through route selection, neighbour discovery and the Ethernet or Wi-Fi frame used on the local link. https://welbournesecurity.com/blue-team/fundamentals/browser-request/network-path-and-enterprise-controls/ https://welbournesecurity.com/blue-team/fundamentals/browser-request/network-path-and-enterprise-controls/#Fundamentals: Network path and enterprise controls Wed, 15 Jul 2026 00:00:00 GMT Compare home routing with proxy, VPN, secure-web-gateway, firewall, NAT, BGP and CDN decisions in a managed network. https://welbournesecurity.com/blue-team/fundamentals/browser-request/tcp-and-quic/ https://welbournesecurity.com/blue-team/fundamentals/browser-request/tcp-and-quic/#Fundamentals: TCP or QUIC transport Wed, 15 Jul 2026 00:00:00 GMT Compare TCP connection establishment with QUIC over UDP, including reliability, multiplexing, reuse and fallback. https://welbournesecurity.com/blue-team/fundamentals/browser-request/tls-and-certificate-validation/ https://welbournesecurity.com/blue-team/fundamentals/browser-request/tls-and-certificate-validation/#Fundamentals: TLS and certificate validation Wed, 15 Jul 2026 00:00:00 GMT Follow TLS 1.3 from ClientHello through certificate validation, key establishment, ALPN and protected application data. https://welbournesecurity.com/blue-team/fundamentals/browser-request/http-request-and-response/ https://welbournesecurity.com/blue-team/fundamentals/browser-request/http-request-and-response/#Fundamentals: HTTP request and response Wed, 15 Jul 2026 00:00:00 GMT Read the same HTTP semantics across text-based HTTP/1.1, framed HTTP/2 and QUIC-carried HTTP/3. https://welbournesecurity.com/blue-team/fundamentals/browser-request/edge-origin-and-application/ https://welbournesecurity.com/blue-team/fundamentals/browser-request/edge-origin-and-application/#Fundamentals: Edge, origin and application processing Wed, 15 Jul 2026 00:00:00 GMT Follow a request through CDN, WAF, reverse proxy, load balancer, web server, application, cache and database components. https://welbournesecurity.com/blue-team/fundamentals/browser-request/navigation-commit-and-security-boundaries/ https://welbournesecurity.com/blue-team/fundamentals/browser-request/navigation-commit-and-security-boundaries/#Fundamentals: Navigation commit and security boundaries Wed, 15 Jul 2026 00:00:00 GMT See how the browser accepts a response, chooses a renderer, commits a document and enforces origin and process boundaries. https://welbournesecurity.com/blue-team/fundamentals/browser-request/browser-rendering-pipeline/ https://welbournesecurity.com/blue-team/fundamentals/browser-request/browser-rendering-pipeline/#Fundamentals: Browser rendering pipeline Wed, 15 Jul 2026 00:00:00 GMT Turn streamed HTML, CSS, scripts and images into layout, paint records, rasterised tiles and composed pixels. https://welbournesecurity.com/blue-team/fundamentals/browser-request/evidence-and-troubleshooting/ https://welbournesecurity.com/blue-team/fundamentals/browser-request/evidence-and-troubleshooting/#Fundamentals: Evidence and troubleshooting Wed, 15 Jul 2026 00:00:00 GMT Correlate browser, endpoint, DNS, network, proxy, edge and application records to find the stage that diverged. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/power-reset-and-reset-vector/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/power-reset-and-reset-vector/#Fundamentals: Power, reset and the CPU reset vector Wed, 15 Jul 2026 00:00:00 GMT Trace the electrical and processor state changes that move a PC from mechanical power-off to its first firmware instruction. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/uefi-post-and-device-enumeration/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/uefi-post-and-device-enumeration/#Fundamentals: UEFI, POST and device enumeration Wed, 15 Jul 2026 00:00:00 GMT See how UEFI discovers memory and devices, executes early diagnostics and builds the firmware view of the machine. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/tpm-measured-boot-and-secure-boot/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/tpm-measured-boot-and-secure-boot/#Fundamentals: TPM measured boot and Secure Boot Wed, 15 Jul 2026 00:00:00 GMT Separate signature enforcement from measurement and follow the evidence that forms the platform boot trust chain. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/boot-manager-and-os-loader/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/boot-manager-and-os-loader/#Fundamentals: Boot manager and operating-system loader Wed, 15 Jul 2026 00:00:00 GMT Follow UEFI from its boot entry into Windows Boot Manager and the loader that prepares the kernel image. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/kernel-initialisation-and-memory/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/kernel-initialisation-and-memory/#Fundamentals: Kernel initialisation and memory management Wed, 15 Jul 2026 00:00:00 GMT See how ntoskrnl.exe takes ownership of processors, virtual memory, interrupts, objects and the first system processes. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/drivers-pnp-storage-filesystems/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/drivers-pnp-storage-filesystems/#Fundamentals: Drivers, Plug and Play, storage and filesystems Wed, 15 Jul 2026 00:00:00 GMT Trace how Windows binds devices to drivers, mounts volumes and makes the system disk available through the I/O stack. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/windows-session-and-service-startup/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/windows-session-and-service-startup/#Fundamentals: Windows session and service startup Wed, 15 Jul 2026 00:00:00 GMT Follow smss.exe, csrss.exe, wininit.exe and services.exe as Windows creates sessions and starts configured services. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/network-interface-and-link-readiness/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/network-interface-and-link-readiness/#Fundamentals: Network interface and link readiness Wed, 15 Jul 2026 00:00:00 GMT See how the NIC driver, NDIS and link technology move an interface from discovered hardware to a usable local link. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/ip-addressing-routes-neighbours/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/ip-addressing-routes-neighbours/#Fundamentals: IP addressing, routes and neighbour discovery Wed, 15 Jul 2026 00:00:00 GMT Follow DHCP or IPv6 autoconfiguration into address selection, routing-table state and the local next-hop mapping. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/dns-time-and-dc-location/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/dns-time-and-dc-location/#Fundamentals: DNS, time and domain-controller location Wed, 15 Jul 2026 00:00:00 GMT Trace the DNS SRV lookups, site awareness and time checks a domain member uses before authentication. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/machine-account-and-secure-channel/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/machine-account-and-secure-channel/#Fundamentals: Machine account and secure channel Wed, 15 Jul 2026 00:00:00 GMT See how a domain member proves its computer identity and maintains the Netlogon secure channel used by domain operations. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/credential-provider-winlogon-sas/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/credential-provider-winlogon-sas/#Fundamentals: Credential Provider, Winlogon and secure attention sequence Wed, 15 Jul 2026 00:00:00 GMT Follow Ctrl+Alt+Delete, LogonUI and the credential provider boundary before authentication reaches LSASS. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/lsass-authentication-and-access-token/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/lsass-authentication-and-access-token/#Fundamentals: LSASS authentication and access-token creation Wed, 15 Jul 2026 00:00:00 GMT Trace local, Microsoft-account and domain credentials through authentication packages into a Windows logon session and access token. https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/user-profile-group-policy-desktop/ https://welbournesecurity.com/blue-team/fundamentals/power-on-and-sign-in/user-profile-group-policy-desktop/#Fundamentals: User profile, Group Policy and desktop shell Wed, 15 Jul 2026 00:00:00 GMT Follow userinit.exe through profile loading, policy processing, logon scripts and the launch of explorer.exe. https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/wireless-hardware-driver-radio/ https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/wireless-hardware-driver-radio/#Fundamentals: Wireless hardware, driver and radio Wed, 15 Jul 2026 00:00:00 GMT Trace a Wi-Fi request from the Windows WLAN service through NDIS and the adapter into a selected radio channel. https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/scanning-beacons-probes/ https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/scanning-beacons-probes/#Fundamentals: Scanning, beacon and probe frames Wed, 15 Jul 2026 00:00:00 GMT Compare passive beacon listening with active probe exchanges and inspect the information elements that describe a wireless network. https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/authentication-and-association/ https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/authentication-and-association/#Fundamentals: 802.11 authentication and association Wed, 15 Jul 2026 00:00:00 GMT Follow the management-frame exchange that creates a Wi-Fi link before WPA or IP configuration completes. https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/wpa2-wpa3-key-establishment/ https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/wpa2-wpa3-key-establishment/#Fundamentals: WPA2, WPA3 and key establishment Wed, 15 Jul 2026 00:00:00 GMT See how personal Wi-Fi turns a passphrase or SAE exchange into per-session keys and protected data frames. https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/8021x-eap-radius/ https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/8021x-eap-radius/#Fundamentals: 802.1X, EAP and RADIUS Wed, 15 Jul 2026 00:00:00 GMT Follow enterprise Wi-Fi identity from the supplicant through the access point to the RADIUS policy server. https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/ipv4-ipv6-configuration/ https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/ipv4-ipv6-configuration/#Fundamentals: IPv4 and IPv6 configuration Wed, 15 Jul 2026 00:00:00 GMT Trace DHCP, router advertisements and duplicate-address checks into a usable dual-stack interface. https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/arp-nd-routing-dns/ https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/arp-nd-routing-dns/#Fundamentals: ARP, neighbour discovery, routing and DNS Wed, 15 Jul 2026 00:00:00 GMT Follow an application name from resolver choice through route selection and next-hop link-layer resolution. https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/captive-portals-connectivity-checks/ https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/captive-portals-connectivity-checks/#Fundamentals: Captive portals and connectivity checks Wed, 15 Jul 2026 00:00:00 GMT See how Windows distinguishes local Wi-Fi association from Internet access and how a portal redirects unauthenticated clients. https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/vpn-identity-policy-routes/ https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/vpn-identity-policy-routes/#Fundamentals: VPN identity, policy and route selection Wed, 15 Jul 2026 00:00:00 GMT Trace a VPN profile from user or device identity through policy checks into full-tunnel or split-tunnel route intent. https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/vpn-handshake-keys-adapter/ https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/vpn-handshake-keys-adapter/#Fundamentals: VPN handshake, keys and virtual adapter creation Wed, 15 Jul 2026 00:00:00 GMT Follow tunnel negotiation from the physical interface to authenticated keys and a virtual network interface. https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/tunnel-traffic-dns-mtu-evidence/ https://welbournesecurity.com/blue-team/fundamentals/wifi-and-vpn/tunnel-traffic-dns-mtu-evidence/#Fundamentals: Tunnel traffic, DNS, MTU and evidence Wed, 15 Jul 2026 00:00:00 GMT Open the nested packet, route and resolver state that governs traffic after the VPN connects. https://welbournesecurity.com/blue-team/fundamentals/email-delivery/compose-draft-local-state/ https://welbournesecurity.com/blue-team/fundamentals/email-delivery/compose-draft-local-state/#Fundamentals: Compose, draft and local state Wed, 15 Jul 2026 00:00:00 GMT See how an email client represents recipients, body content and attachments before any submission starts. https://welbournesecurity.com/blue-team/fundamentals/email-delivery/mailbox-session-identity-oauth/ https://welbournesecurity.com/blue-team/fundamentals/email-delivery/mailbox-session-identity-oauth/#Fundamentals: Mailbox session, identity and OAuth Wed, 15 Jul 2026 00:00:00 GMT Trace a modern mail client from cached account state through token acquisition to an authorised mailbox session. https://welbournesecurity.com/blue-team/fundamentals/email-delivery/message-format-mime-attachments/ https://welbournesecurity.com/blue-team/fundamentals/email-delivery/message-format-mime-attachments/#Fundamentals: Message format, MIME and attachments Wed, 15 Jul 2026 00:00:00 GMT Open the message envelope and content tree that turn rich text, alternative bodies and files into Internet Message Format bytes. https://welbournesecurity.com/blue-team/fundamentals/email-delivery/submission-service-discovery/ https://welbournesecurity.com/blue-team/fundamentals/email-delivery/submission-service-discovery/#Fundamentals: Submission-service discovery Wed, 15 Jul 2026 00:00:00 GMT See how a client finds the right mailbox or SMTP submission endpoint before it sends message content. https://welbournesecurity.com/blue-team/fundamentals/email-delivery/smtp-submission-tls-authentication/ https://welbournesecurity.com/blue-team/fundamentals/email-delivery/smtp-submission-tls-authentication/#Fundamentals: SMTP submission, TLS and authentication Wed, 15 Jul 2026 00:00:00 GMT Follow EHLO, STARTTLS, authentication and the SMTP envelope from a client to a submission server. https://welbournesecurity.com/blue-team/fundamentals/email-delivery/queues-dns-mx-recipient-routing/ https://welbournesecurity.com/blue-team/fundamentals/email-delivery/queues-dns-mx-recipient-routing/#Fundamentals: Queues, DNS MX and recipient routing Wed, 15 Jul 2026 00:00:00 GMT Trace an accepted message through queue selection, recipient-domain lookup and next-hop calculation. https://welbournesecurity.com/blue-team/fundamentals/email-delivery/server-to-server-smtp-transport-security/ https://welbournesecurity.com/blue-team/fundamentals/email-delivery/server-to-server-smtp-transport-security/#Fundamentals: Server-to-server SMTP and transport security Wed, 15 Jul 2026 00:00:00 GMT Follow Internet mail between autonomous servers and separate opportunistic encryption from authenticated routing policy. https://welbournesecurity.com/blue-team/fundamentals/email-delivery/spf-dkim-dmarc/ https://welbournesecurity.com/blue-team/fundamentals/email-delivery/spf-dkim-dmarc/#Fundamentals: SPF, DKIM and DMARC Wed, 15 Jul 2026 00:00:00 GMT Separate source authorisation, message signatures and domain-alignment policy during receiving-mail evaluation. https://welbournesecurity.com/blue-team/fundamentals/email-delivery/gateway-filtering-scanning-sandboxing/ https://welbournesecurity.com/blue-team/fundamentals/email-delivery/gateway-filtering-scanning-sandboxing/#Fundamentals: Gateway filtering, scanning and sandboxing Wed, 15 Jul 2026 00:00:00 GMT Trace message, attachment and URL evidence through layered mail-security decisions before mailbox delivery. https://welbournesecurity.com/blue-team/fundamentals/email-delivery/mailbox-delivery-storage-indexing/ https://welbournesecurity.com/blue-team/fundamentals/email-delivery/mailbox-delivery-storage-indexing/#Fundamentals: Mailbox delivery, storage and indexing Wed, 15 Jul 2026 00:00:00 GMT Follow the accepted message into mailbox folders, metadata tables, quotas and search indexes. https://welbournesecurity.com/blue-team/fundamentals/email-delivery/sync-notifications-rendering-evidence/ https://welbournesecurity.com/blue-team/fundamentals/email-delivery/sync-notifications-rendering-evidence/#Fundamentals: Synchronisation, notifications, rendering and evidence Wed, 15 Jul 2026 00:00:00 GMT Trace a delivered item into the recipient client, local cache and rendered message while preserving cross-system correlation. https://welbournesecurity.com/blue-team/fundamentals/network-file-access/path-parsing-unc-dfs/ https://welbournesecurity.com/blue-team/fundamentals/network-file-access/path-parsing-unc-dfs/#Fundamentals: Path parsing, UNC paths and DFS Wed, 15 Jul 2026 00:00:00 GMT See how Windows separates a local path, a UNC server-share path and a DFS namespace before network I/O begins. https://welbournesecurity.com/blue-team/fundamentals/network-file-access/client-redirector-vfs-cache/ https://welbournesecurity.com/blue-team/fundamentals/network-file-access/client-redirector-vfs-cache/#Fundamentals: Client redirector, VFS and local cache Wed, 15 Jul 2026 00:00:00 GMT Trace a file open from the Windows I/O Manager through the SMB redirector and Client-Side Caching decisions. https://welbournesecurity.com/blue-team/fundamentals/network-file-access/name-resolution-site-server-discovery/ https://welbournesecurity.com/blue-team/fundamentals/network-file-access/name-resolution-site-server-discovery/#Fundamentals: Name resolution, site and server discovery Wed, 15 Jul 2026 00:00:00 GMT Follow a UNC hostname or DFS namespace through DNS, suffix search, Active Directory site logic and referral selection. https://welbournesecurity.com/blue-team/fundamentals/network-file-access/routing-transport-port-445/ https://welbournesecurity.com/blue-team/fundamentals/network-file-access/routing-transport-port-445/#Fundamentals: Routing, transport and port 445 Wed, 15 Jul 2026 00:00:00 GMT Trace the selected file server through route lookup, neighbour resolution and TCP connection establishment to SMB Direct Hosting. https://welbournesecurity.com/blue-team/fundamentals/network-file-access/smb-negotiation-signing-encryption/ https://welbournesecurity.com/blue-team/fundamentals/network-file-access/smb-negotiation-signing-encryption/#Fundamentals: SMB negotiation, signing and encryption Wed, 15 Jul 2026 00:00:00 GMT Inspect SMB2 NEGOTIATE fields, dialect choice, capabilities and pre-authentication protection before user authentication. https://welbournesecurity.com/blue-team/fundamentals/network-file-access/session-setup-spnego-kerberos-ntlm/ https://welbournesecurity.com/blue-team/fundamentals/network-file-access/session-setup-spnego-kerberos-ntlm/#Fundamentals: Session setup, SPNEGO, Kerberos and NTLM Wed, 15 Jul 2026 00:00:00 GMT Follow SMB SESSION_SETUP through protocol negotiation into Kerberos service-ticket or NTLM challenge-response authentication. https://welbournesecurity.com/blue-team/fundamentals/network-file-access/tree-connect-shares-namespaces/ https://welbournesecurity.com/blue-team/fundamentals/network-file-access/tree-connect-shares-namespaces/#Fundamentals: Tree connect, shares and namespaces Wed, 15 Jul 2026 00:00:00 GMT See how an authenticated SMB session attaches to a named share and turns a relative path into a server-side namespace. https://welbournesecurity.com/blue-team/fundamentals/network-file-access/access-tokens-share-permissions-acls/ https://welbournesecurity.com/blue-team/fundamentals/network-file-access/access-tokens-share-permissions-acls/#Fundamentals: Access tokens, share permissions and ACLs Wed, 15 Jul 2026 00:00:00 GMT Follow an SMB request through share checks, NTFS security descriptors and the effective access decision. https://welbournesecurity.com/blue-team/fundamentals/network-file-access/file-open-leases-oplocks-io-close/ https://welbournesecurity.com/blue-team/fundamentals/network-file-access/file-open-leases-oplocks-io-close/#Fundamentals: File open, leases, oplocks, I/O and close Wed, 15 Jul 2026 00:00:00 GMT Trace SMB CREATE through durable handles, caching leases, reads, writes, flushes and final close semantics. https://welbournesecurity.com/blue-team/fundamentals/network-file-access/audit-failures-troubleshooting/ https://welbournesecurity.com/blue-team/fundamentals/network-file-access/audit-failures-troubleshooting/#Fundamentals: Audit evidence, failures and troubleshooting Wed, 15 Jul 2026 00:00:00 GMT Correlate client, DNS, Kerberos, SMB, server and filesystem evidence to find the first divergent state. https://welbournesecurity.com/blue-team/scenario-lab/power-on-to-enterprise-website/ https://welbournesecurity.com/blue-team/scenario-lab/power-on-to-enterprise-website/#Scenario Lab: Power-on to an enterprise website Tue, 14 Jul 2026 00:00:00 GMT Trace a managed PC from electrical reset through firmware, network and domain identity to DNS, BGP, TLS, WAF, application and database. https://welbournesecurity.com/blue-team/scenario-lab/windows-domain-sign-in/ https://welbournesecurity.com/blue-team/scenario-lab/windows-domain-sign-in/#Scenario Lab: Windows domain sign-in and Group Policy Tue, 14 Jul 2026 00:00:00 GMT Follow DC discovery, machine trust, user authentication, access-token creation and policy application on a Windows endpoint. https://welbournesecurity.com/blue-team/scenario-lab/linux-boot-to-service/ https://welbournesecurity.com/blue-team/scenario-lab/linux-boot-to-service/#Scenario Lab: Linux boot to an exposed service Tue, 14 Jul 2026 00:00:00 GMT Trace a Linux server from firmware and kernel initialisation through systemd dependencies to a listening and logged network service. https://welbournesecurity.com/blue-team/scenario-lab/vm-provisioning-and-monitoring/ https://welbournesecurity.com/blue-team/scenario-lab/vm-provisioning-and-monitoring/#Scenario Lab: VM provisioning and monitoring Tue, 14 Jul 2026 00:00:00 GMT Provision a virtual machine through the management plane, virtual network, approved image and security-control bootstrap. https://welbournesecurity.com/blue-team/scenario-lab/wired-enterprise-onboarding/ https://welbournesecurity.com/blue-team/scenario-lab/wired-enterprise-onboarding/#Scenario Lab: Wired enterprise onboarding Tue, 14 Jul 2026 00:00:00 GMT Connect a new managed device through link state, 802.1X, RADIUS policy, DHCP, DNS and domain discovery. https://welbournesecurity.com/blue-team/scenario-lab/corporate-wifi-and-8021x/ https://welbournesecurity.com/blue-team/scenario-lab/corporate-wifi-and-8021x/#Scenario Lab: Corporate Wi-Fi and 802.1X Tue, 14 Jul 2026 00:00:00 GMT Join an enterprise wireless network, validate RADIUS identity and recognise an evil-twin diversion. https://welbournesecurity.com/blue-team/scenario-lab/remote-worker-vpn-to-saas/ https://welbournesecurity.com/blue-team/scenario-lab/remote-worker-vpn-to-saas/#Scenario Lab: Remote worker through VPN to SaaS Tue, 14 Jul 2026 00:00:00 GMT Trace device posture, MFA, VPN routes and DNS through federated SaaS authentication and session audit. https://welbournesecurity.com/blue-team/scenario-lab/mobile-enrolment-and-email/ https://welbournesecurity.com/blue-team/scenario-lab/mobile-enrolment-and-email/#Scenario Lab: Mobile enrolment and corporate email Tue, 14 Jul 2026 00:00:00 GMT Follow a mobile device through MDM enrolment, compliance, certificate-backed access, SaaS identity and mailbox activity. https://welbournesecurity.com/blue-team/scenario-lab/internal-client-to-internet/ https://welbournesecurity.com/blue-team/scenario-lab/internal-client-to-internet/#Scenario Lab: Internal client through proxy, NAT, firewalls and BGP Tue, 14 Jul 2026 00:00:00 GMT Separate local forwarding, enterprise policy and external route selection on a normal outbound web session. https://welbournesecurity.com/blue-team/scenario-lab/public-user-to-web-application/ https://welbournesecurity.com/blue-team/scenario-lab/public-user-to-web-application/#Scenario Lab: Public user through DNS, CDN, WAF and load balancer Tue, 14 Jul 2026 00:00:00 GMT Trace a public request through authoritative DNS, Internet routing, TLS and edge security to a selected application backend. https://welbournesecurity.com/blue-team/scenario-lab/email-authentication-and-delivery/ https://welbournesecurity.com/blue-team/scenario-lab/email-authentication-and-delivery/#Scenario Lab: Email authentication and delivery Tue, 14 Jul 2026 00:00:00 GMT Follow message submission, DNS-based sender authentication, filtering, delivery and mailbox audit evidence. https://welbournesecurity.com/blue-team/scenario-lab/branch-routing-failure/ https://welbournesecurity.com/blue-team/scenario-lab/branch-routing-failure/#Scenario Lab: Branch routing failure Tue, 14 Jul 2026 00:00:00 GMT Diagnose link, OSPF, BGP, DNS and time dependencies without assuming every outage is an attack. https://welbournesecurity.com/blue-team/scenario-lab/web-session-to-database/ https://welbournesecurity.com/blue-team/scenario-lab/web-session-to-database/#Scenario Lab: Web session to database Tue, 14 Jul 2026 00:00:00 GMT Follow browser identity, session state, application authorisation, parameterised queries and database audit evidence. https://welbournesecurity.com/blue-team/scenario-lab/abused-api-cloud-token/ https://welbournesecurity.com/blue-team/scenario-lab/abused-api-cloud-token/#Scenario Lab: Abused API and cloud token Tue, 14 Jul 2026 00:00:00 GMT Investigate a stolen cloud token crossing gateway, service authorisation and data-access boundaries. https://welbournesecurity.com/blue-team/scenario-lab/cicd-to-kubernetes/ https://welbournesecurity.com/blue-team/scenario-lab/cicd-to-kubernetes/#Scenario Lab: CI/CD image to Kubernetes Tue, 14 Jul 2026 00:00:00 GMT Trace source and dependencies through a trusted build, registry admission, cluster identity and runtime telemetry. https://welbournesecurity.com/blue-team/scenario-lab/backup-failure-and-ransomware-recovery/ https://welbournesecurity.com/blue-team/scenario-lab/backup-failure-and-ransomware-recovery/#Scenario Lab: Backup failure and ransomware recovery Tue, 14 Jul 2026 00:00:00 GMT Contain active ransomware safely, protect identity and backup control planes, determine clean scope and restore validated services in dependency order. https://welbournesecurity.com/blue-team/scenario-lab/alert-to-case/ https://welbournesecurity.com/blue-team/scenario-lab/alert-to-case/#Scenario Lab: Alert through SIEM, SOAR and case queue Tue, 14 Jul 2026 00:00:00 GMT Trace raw telemetry through collection, parsing, enrichment and detection into accountable analyst triage. https://welbournesecurity.com/blue-team/scenario-lab/phishing-and-bec-triage/ https://welbournesecurity.com/blue-team/scenario-lab/phishing-and-bec-triage/#Scenario Lab: Phishing and BEC triage Tue, 14 Jul 2026 00:00:00 GMT Preserve a suspicious message, trace delivery and authentication, prove user action, scope identity impact and choose proportionate containment. https://welbournesecurity.com/blue-team/scenario-lab/malware-persistence-and-c2/ https://welbournesecurity.com/blue-team/scenario-lab/malware-persistence-and-c2/#Scenario Lab: Malware execution, persistence and C2 Tue, 14 Jul 2026 00:00:00 GMT Build a process and network timeline from initial execution through persistence and command-and-control. https://welbournesecurity.com/blue-team/scenario-lab/kerberos-ntlm-ldap-compromise/ https://welbournesecurity.com/blue-team/scenario-lab/kerberos-ntlm-ldap-compromise/#Scenario Lab: Kerberos, NTLM and LDAP identity compromise Tue, 14 Jul 2026 00:00:00 GMT Separate ticketing, compatibility authentication and directory access while investigating credential and privilege abuse. https://welbournesecurity.com/blue-team/scenario-lab/vulnerability-to-remediation/ https://welbournesecurity.com/blue-team/scenario-lab/vulnerability-to-remediation/#Scenario Lab: Vulnerability to risk treatment and remediation Tue, 14 Jul 2026 00:00:00 GMT Move from a scanner finding to validated exposure, business impact, treatment, control testing and residual risk. https://welbournesecurity.com/blue-team/scenario-lab/evil-twin-and-dns-poisoning/ https://welbournesecurity.com/blue-team/scenario-lab/evil-twin-and-dns-poisoning/#Scenario Lab: Evil twin and DNS poisoning Tue, 14 Jul 2026 00:00:00 GMT Investigate a wireless lookalike, weak server validation, rogue DHCP and poisoned name resolution. https://welbournesecurity.com/blue-team/scenario-lab/data-exfiltration-and-privacy-response/ https://welbournesecurity.com/blue-team/scenario-lab/data-exfiltration-and-privacy-response/#Scenario Lab: Data exfiltration and privacy response Tue, 14 Jul 2026 00:00:00 GMT Correlate identity, data and network evidence, contain safely and translate technical scope into privacy and partner decisions. https://welbournesecurity.com/blue-team/scenario-lab/third-party-incident-and-collection-gaps/ https://welbournesecurity.com/blue-team/scenario-lab/third-party-incident-and-collection-gaps/#Scenario Lab: Third-party incident and collection gaps Tue, 14 Jul 2026 00:00:00 GMT Scope a supplier compromise when direct telemetry is incomplete and reporting duties cross organisational boundaries. https://welbournesecurity.com/writeups/thm/purple/thm-h4cked/ https://welbournesecurity.com/writeups/thm/purple/thm-h4cked/#Writeup: h4cked Fri, 03 Jul 2026 00:00:00 GMT TryHackMe room using a packet capture to reconstruct an FTP compromise, identify the attacker's web shell path, then replay the intrusion to recover the root flag. https://welbournesecurity.com/writeups/thm/purple/thm-reversing-elf/ https://welbournesecurity.com/writeups/thm/purple/thm-reversing-elf/#Writeup: Reversing ELF Fri, 03 Jul 2026 00:00:00 GMT TryHackMe beginner reverse-engineering room solving a set of ELF crackmes with execution, strings, Ghidra, Cutter, base64 decoding, XOR, and simple argument checks. https://welbournesecurity.com/writeups/thm/blue/thm-lockdown/ https://welbournesecurity.com/writeups/thm/blue/thm-lockdown/#Writeup: Lockdown Thu, 02 Jul 2026 00:00:00 GMT TryHackMe AI security room investigating Bastion, an internal assistant with vulnerable retrieval controls, unsafe logging, and broken user-level access isolation. https://welbournesecurity.com/writeups/thm/blue/thm-mondaymonitor/ https://welbournesecurity.com/writeups/thm/blue/thm-mondaymonitor/#Writeup: Monday Monitor Thu, 02 Jul 2026 00:00:00 GMT TryHackMe endpoint monitoring room using Wazuh and Sysmon logs to trace initial access, scheduled task persistence, user creation, credential dumping, and data exfiltration. https://welbournesecurity.com/writeups/thm/blue/thm-posheclipse/ https://welbournesecurity.com/writeups/thm/blue/thm-posheclipse/#Writeup: PS Eclipse Thu, 02 Jul 2026 00:00:00 GMT TryHackMe Splunk investigation room tracing a suspected ransomware incident through PowerShell download activity, scheduled task privilege escalation, C2 callbacks, and BlackSun ransomware IOCs. https://welbournesecurity.com/writeups/thm/blue/thm-snappedphishingline/ https://welbournesecurity.com/writeups/thm/blue/thm-snappedphishingline/#Writeup: Snapped Phish-ing Line Thu, 02 Jul 2026 00:00:00 GMT TryHackMe phishing investigation room analysing malicious emails, redirection URLs, an exposed phishing kit, captured credentials, VirusTotal results, and a decoded flag. https://welbournesecurity.com/writeups/thm/blue/thm-tsharkchallenge1-teamwork/ https://welbournesecurity.com/writeups/thm/blue/thm-tsharkchallenge1-teamwork/#Writeup: TShark Challenge I - Teamwork Thu, 02 Jul 2026 00:00:00 GMT TryHackMe network forensics room using TShark to investigate DNS traffic, identify a suspicious phishing domain, pivot through VirusTotal, and extract an email address from a PCAP. https://welbournesecurity.com/writeups/thm/blue/thm-tsharkchallenge2-directory/ https://welbournesecurity.com/writeups/thm/blue/thm-tsharkchallenge2-directory/#Writeup: TShark Challenge II - Directory Thu, 02 Jul 2026 00:00:00 GMT TryHackMe network forensics room using TShark to investigate directory-index browsing, identify a suspicious domain, export HTTP objects, and validate a downloaded executable in VirusTotal. https://welbournesecurity.com/writeups/thm/blue/thm-warzone1/ https://welbournesecurity.com/writeups/thm/blue/thm-warzone1/#Writeup: Warzone 1 Thu, 02 Jul 2026 00:00:00 GMT TryHackMe SOC triage room investigating an IDS alert with Brim, Wireshark, NetworkMiner, and VirusTotal to confirm malware command and control activity. https://welbournesecurity.com/writeups/thm/blue/thm-warzone2/ https://welbournesecurity.com/writeups/thm/blue/thm-warzone2/#Writeup: Warzone 2 Thu, 02 Jul 2026 00:00:00 GMT TryHackMe SOC triage room investigating IDS alerts for a network trojan, privacy-policy violations, malicious downloads, and related suspicious infrastructure. https://welbournesecurity.com/writeups/thm/purple/thm-checkpoint/ https://welbournesecurity.com/writeups/thm/purple/thm-checkpoint/#Writeup: Checkpoint Thu, 02 Jul 2026 00:00:00 GMT TryHackMe AI security assessment room reviewing four deployment candidates, identifying Candidate A's supply-chain failures, and making the production deployment call. https://welbournesecurity.com/writeups/thm/purple/thm-compiled/ https://welbournesecurity.com/writeups/thm/purple/thm-compiled/#Writeup: Compiled Thu, 02 Jul 2026 00:00:00 GMT TryHackMe reverse-engineering room using Ghidra to inspect a Linux binary, understand scanf input parsing, and recover the required password. https://welbournesecurity.com/writeups/thm/purple/thm-sakura/ https://welbournesecurity.com/writeups/thm/purple/thm-sakura/#Writeup: Sakura Room Thu, 02 Jul 2026 00:00:00 GMT TryHackMe OSINT room using source inspection, username pivoting, GitHub history, PGP metadata, blockchain lookup, social media, WiGLE, and travel geolocation. https://welbournesecurity.com/writeups/thm/purple/thm-searchlight-imint/ https://welbournesecurity.com/writeups/thm/purple/thm-searchlight-imint/#Writeup: Searchlight - IMINT Thu, 02 Jul 2026 00:00:00 GMT TryHackMe OSINT room covering imagery intelligence, geolocation, Google dorking, reverse image search, street view checks, and video frame analysis. https://welbournesecurity.com/writeups/thm/blue/thm-aithreatmodellingassessment/ https://welbournesecurity.com/writeups/thm/blue/thm-aithreatmodellingassessment/#Writeup: AI Threat Modelling Assessment Wed, 01 Jul 2026 00:00:00 GMT TryHackMe assessment room testing AI threat modelling knowledge through an interactive application and two completion flags. https://welbournesecurity.com/writeups/thm/blue/thm-disgruntled/ https://welbournesecurity.com/writeups/thm/blue/thm-disgruntled/#Writeup: Disgruntled Wed, 01 Jul 2026 00:00:00 GMT TryHackMe Linux forensics room investigating a disgruntled IT user's privileged commands, account creation, script staging, cron persistence, and logic bomb. https://welbournesecurity.com/writeups/thm/blue/thm-hideandseek/ https://welbournesecurity.com/writeups/thm/blue/thm-hideandseek/#Writeup: Hide and Seek Wed, 01 Jul 2026 00:00:00 GMT TryHackMe Linux live-system forensics room uncovering multiple post-compromise persistence mechanisms and reconstructing a split flag from encoded artefacts. https://welbournesecurity.com/writeups/thm/blue/thm-infinityshell/ https://welbournesecurity.com/writeups/thm/blue/thm-infinityshell/#Writeup: Infinity Shell Wed, 01 Jul 2026 00:00:00 GMT TryHackMe webshell forensics room investigating a PHP implant, tracing attacker query strings, and decoding a base64 payload to recover the flag. https://welbournesecurity.com/writeups/thm/blue/thm-inviteonly/ https://welbournesecurity.com/writeups/thm/blue/thm-inviteonly/#Writeup: Invite Only Wed, 01 Jul 2026 00:00:00 GMT TryHackMe SOC threat-intelligence room pivoting from a flagged IP and SHA256 hash to malware family, dropped files, phishing technique, and campaign reporting. https://welbournesecurity.com/writeups/thm/blue/thm-juicydetails/ https://welbournesecurity.com/writeups/thm/blue/thm-juicydetails/#Writeup: Juicy Details Wed, 01 Jul 2026 00:00:00 GMT TryHackMe SOC log-analysis room investigating attacker reconnaissance, brute forcing, SQL injection, file retrieval, and shell access against a Juice Shop environment. https://welbournesecurity.com/writeups/thm/blue/thm-letter/ https://welbournesecurity.com/writeups/thm/blue/thm-letter/#Writeup: Letter Wed, 01 Jul 2026 00:00:00 GMT TryHackMe OSINT room using a damaged envelope, handwritten note, and newspaper clipping to identify a historic Penmarc'h rescue figure. https://welbournesecurity.com/writeups/thm/blue/thm-memoryforensics/ https://welbournesecurity.com/writeups/thm/blue/thm-memoryforensics/#Writeup: Memory Forensics Wed, 01 Jul 2026 00:00:00 GMT TryHackMe memory forensics room using Volatility to identify profiles, dump and crack Windows hashes, recover console activity, find shutdown time, and extract a TrueCrypt passphrase. https://welbournesecurity.com/writeups/thm/blue/thm-missingperson/ https://welbournesecurity.com/writeups/thm/blue/thm-missingperson/#Writeup: Missing Person Wed, 01 Jul 2026 00:00:00 GMT TryHackMe OSINT room using image search, event research, EXIF metadata, social media, and public business details to trace a missing person's travel trail. https://welbournesecurity.com/writeups/thm/blue/thm-mrphisher/ https://welbournesecurity.com/writeups/thm/blue/thm-mrphisher/#Writeup: Mr. Phisher Wed, 01 Jul 2026 00:00:00 GMT TryHackMe phishing analysis room focused on extracting and decoding a flag hidden inside a macro-enabled Word document attachment. https://welbournesecurity.com/writeups/thm/blue/thm-payload/ https://welbournesecurity.com/writeups/thm/blue/thm-payload/#Writeup: Payload Wed, 01 Jul 2026 00:00:00 GMT TryHackMe supply-chain incident room investigating a backdoored ML model, outbound beaconing, and a staged candidate model containing the second half of the campaign ID. https://welbournesecurity.com/writeups/thm/blue/thm-phishingemails5/ https://welbournesecurity.com/writeups/thm/blue/thm-phishingemails5/#Writeup: Phishing Emails 5 Wed, 01 Jul 2026 00:00:00 GMT TryHackMe phishing analysis room focused on investigating an email sample through headers, sender artifacts, SPF and DMARC checks, attachment hashing, and VirusTotal. https://welbournesecurity.com/writeups/thm/blue/thm-shadowtrace/ https://welbournesecurity.com/writeups/thm/blue/thm-shadowtrace/#Writeup: Shadow Trace Wed, 01 Jul 2026 00:00:00 GMT TryHackMe malware triage room analysing a suspicious Windows updater, extracting IOCs, decoding hidden clues, and correlating EDR alert payloads. https://welbournesecurity.com/writeups/thm/blue/thm-sneakypatch/ https://welbournesecurity.com/writeups/thm/blue/thm-sneakypatch/#Writeup: Sneaky Patch Wed, 01 Jul 2026 00:00:00 GMT TryHackMe Linux forensics room investigating a suspicious kernel module and recovering a hidden flag from a backdoored `.ko` file. https://welbournesecurity.com/writeups/thm/blue/thm-stolenmount/ https://welbournesecurity.com/writeups/thm/blue/thm-stolenmount/#Writeup: Stolen Mount Wed, 01 Jul 2026 00:00:00 GMT TryHackMe packet forensics room analysing NFS traffic, extracting stolen files from a PCAP, cracking an archive password, and recovering a QR-code flag. https://welbournesecurity.com/writeups/thm/blue/thm-confidential/ https://welbournesecurity.com/writeups/thm/blue/thm-confidential/#Writeup: Confidential Tue, 30 Jun 2026 00:00:00 GMT TryHackMe PDF forensics room focused on uncovering an obscured QR code and decoding it to retrieve the hidden invite flag. https://welbournesecurity.com/writeups/thm/blue/thm-committed/ https://welbournesecurity.com/writeups/thm/blue/thm-committed/#Writeup: Committed Mon, 29 Jun 2026 00:00:00 GMT TryHackMe Git forensics room focused on recovering a sensitive flag from repository history after it was removed in a later commit. https://welbournesecurity.com/writeups/thm/blue/thm-disk-analysis-autopsy/ https://welbournesecurity.com/writeups/thm/blue/thm-disk-analysis-autopsy/#Writeup: Disk Analysis & Autopsy Mon, 29 Jun 2026 00:00:00 GMT TryHackMe forensic analysis room using Autopsy to investigate a Windows disk image, recover system details, user activity, network artifacts, tools, and flags. https://welbournesecurity.com/writeups/thm/blue/thm-investigatingwindows/ https://welbournesecurity.com/writeups/thm/blue/thm-investigatingwindows/#Writeup: Investigating Windows Mon, 29 Jun 2026 00:00:00 GMT TryHackMe Windows forensics room investigating a previously compromised Windows Server host through RDP, account activity, scheduled tasks, logs, network artifacts, and web shell evidence. https://welbournesecurity.com/writeups/thm/blue/thm-summit/ https://welbournesecurity.com/writeups/thm/blue/thm-summit/#Writeup: Summit Mon, 29 Jun 2026 00:00:00 GMT TryHackMe purple-team detection engineering challenge using the Pyramid of Pain to detect malware through hashes, IPs, domains, host artifacts, tool behavior, and attacker procedures. https://welbournesecurity.com/writeups/thm/red/thm-crackthehash/ https://welbournesecurity.com/writeups/thm/red/thm-crackthehash/#Writeup: Crack the Hash Mon, 29 Jun 2026 00:00:00 GMT TryHackMe hash cracking room covering common hashes, CrackStation lookups, and Hashcat modes for bcrypt, SHA-512 crypt, and salted SHA1. https://welbournesecurity.com/writeups/thm/red/thm-toolsrus/ https://welbournesecurity.com/writeups/thm/red/thm-toolsrus/#Writeup: ToolsRus Mon, 29 Jun 2026 00:00:00 GMT TryHackMe room using Feroxbuster, Hydra, Nmap, Nikto, and Metasploit to enumerate and exploit an exposed Apache Tomcat Manager instance. https://welbournesecurity.com/writeups/thm/red/thm-chillhack/ https://welbournesecurity.com/writeups/thm/red/thm-chillhack/#Writeup: Chill Hack Wed, 08 Apr 2026 00:00:00 GMT TryHackMe boot-to-root room covering FTP enumeration, web command injection, reverse shells, and Linux privilege escalation. https://welbournesecurity.com/writeups/thm/red/thm-archangel/ https://welbournesecurity.com/writeups/thm/red/thm-archangel/#Writeup: Archangel Tue, 07 Apr 2026 00:00:00 GMT TryHackMe boot-to-root room covering hostname discovery, local file inclusion, log poisoning, callback shell access, and Linux privilege escalation. https://welbournesecurity.com/writeups/thm/red/thm-blue/ https://welbournesecurity.com/writeups/thm/red/thm-blue/#Writeup: Blue Mon, 06 Apr 2026 00:00:00 GMT TryHackMe beginner Windows exploitation room focused on SMB enumeration, MS17-010 EternalBlue exploitation, Meterpreter migration, hash dumping, and flag discovery. https://welbournesecurity.com/writeups/htb/htb-footprinting/ https://welbournesecurity.com/writeups/htb/htb-footprinting/#Writeup: Footprinting Lab Sun, 05 Apr 2026 00:00:00 GMT Hack The Box Academy footprinting lab focused on careful service enumeration, FTP access, SSH key discovery, and retrieving the proof flag. https://welbournesecurity.com/writeups/thm/red/thm-lofi/ https://welbournesecurity.com/writeups/thm/red/thm-lofi/#Writeup: Lofi Sun, 05 Apr 2026 00:00:00 GMT TryHackMe beginner web room demonstrating local file inclusion through a vulnerable page parameter to read the flag from the filesystem.