This lab simulates and detects real-world attack techniques (Kerberoasting, Credential Dumping) in a self-built Active Directory environment with a Splunk SIEM.

This lab follows the NIST Incident Response process to investigate a simulated insider-threat data leak, from AD audit policy setup and a honey file, through log analysis, to containment and lessons learned.

• •Led Montgomery College's team to 2nd place overall, earning 9.325 points and 19 of 27 flags across Digital Forensics, Web Exploitation, Reverse Engineering, OSINT, and Secure Coding.
• •Captured 14 of 15 Digital Forensics flags by performing Azure cloud log forensics using jq to parse JSON logs, identifying account compromise and malware activity indicators.
• •Identified a Server-Side Request Forgery through source code analysis and implemented a fix.

• •Ranked 214th out of 3,634 teams nationwide while competing across OSINT, Cryptography, Forensics, Log Analysis, Network Traffic Analysis, Web Application Security, and Exploitation.
• •Achieved 100% completion and 100% accuracy in Network Traffic Analysis challenges through packet analysis, traffic reconstruction, and threat identification using Wireshark.
• •Analyzed memory dumps, disk images, and binaries using Volatility, Autopsy, and Binwalk; identified web vulnerabilities and automated log analysis tasks with Python scripts.

• •Completed 21 objectives across web exploitation, network analysis, cloud security, and reverse engineering.
• •Exploited IDOR vulnerabilities, performed RCE with privilege escalation, and bypassed authentications.
• •Identified Azure Blob Storage misconfigurations, hunted leaked tokens, and analyzed NSG firewall rules to detect privilege violations.
• •Exploited JWT/JWKS authentication weakness by generating RSA key pairs with OpenSSL and forging trusted tokens to bypass authorization controls.