CyberDefenders

A question every security leader should ask their team:
When did you last train against an attack that looked completely normal, until it wasn't?

Not a phishing simulation. Not a compliance drill.
A real adversary chain: identity abuse, cloud pivoting, AI supply chain compromise, and a destructive wiper; all in a single engagement.

That's what we built for Locked Shields 2026. We're announcing that CyberDefenders is an official scenario design partner for NATO CCDCOE Locked Shields 2026, the world's most demanding live-fire cyber defense exercise.

Teams that worked through our scenario didn't just learn techniques. They learned where their visibility actually ends , not where they assumed it did. They discovered which assumptions in their Conditional Access policies and IAM boundaries hold under adversarial pressure, and which ones collapse in minutes.

Closing that gap is exactly why we exist: https://f.mtr.cool/rkqunvakvq

3 questions every SOC alert must answer before an analyst moves on. 🔍
Is this real? How serious is it? What do we do next?

Simple questions, but without a structured process, most teams answer them inconsistently.
That inconsistency is where threats slip through. We just published a comprehensive guide to the SOC alert triage process, covering each of the 7 stages with the specific actions, tools, and decision criteria that drive accurate outcomes. 🕵️
Whether you're building a SOC from scratch or refining an existing workflow, this is your reference.
📖 Read the full article: https://f.mtr.cool/brzksboqon

New Lab Drop: CodeFreeze - Endpoint Forensics 🧊
After completing the Lab, you'll learn how to:
✅ Reconstruct a complete attack timeline from endpoint artifacts.
✅ Identify attacker persistence using Windows registry analysis.
✅ Detect credential exfiltration through Git and browser forensics.
✅ Correlate event log data to map the full kill chain.

This is the lab that builds the skills hiring managers are actually looking for in DFIR roles. 🧑‍💼
Investigate here: https://f.mtr.cool/auktntsolc

Most SOC teams aren't protecting the things attackers actually want.
They're watching the front door while the attacker has already been sitting in the living room for six weeks. 🔓

Inside the full article, you'll find:
✔ The attacker's priority stack, and where your detection coverage should actually sit.
✔ The behavioral indicators you're probably missing right now.
✔ Why patient attackers are invisible to most SIEM logic, and what to do about it.

📖 Read the full blog: https://f.mtr.cool/mkampopsnf

We just published a step-by-step technical case study walking you through exactly how SOC analysts should investigate and respond to an M365 cloud compromise. 💻

Inside the case study, you'll learn how to:
✅ Analyze mailbox audit logs to build an attack timeline
✅ Detect OAuth token abuse and suspicious app consent
✅ Identify thread hijacking and executive impersonation techniques
✅ Contain and remediate the incident with confidence.
Whether you're a junior SOC analyst or a seasoned IR professional, this is the kind of hands-on, log-level detail that sharpens your investigative instincts. Stop reading theory. Start practicing with real-world scenarios.
🔗 Read the full case study now → https://f.mtr.cool/fdsxeyivjd

Attackers don’t behave the same way in theory vs reality. 🕵️
Honeypots expose the difference.
From:
- Initial access attempts.
- Credential abuse.
- Lateral movement patterns.
You get actual attacker behavior… not assumptions. 🔍
That’s gold for tuning detections in a SOC.
👉 Check the full guide: https://f.mtr.cool/efunjljtac

Most AWS breaches don’t start with “hacking the cloud”… ☁️
They start with misconfiguration + identity abuse.

Minimum baseline:
🔹 CloudTrail → API activity
🔹 VPC Flow Logs → network visibility
🔹 CloudWatch → service telemetry
Without these, incident response in AWS becomes guesswork. 🔍
👉 Check the Full AWS Guide: https://f.mtr.cool/tlnwlctgrc

Your CSPM covers your cloud. Your EDR covers your endpoints.🔐

Neither covers your developers' IDE plugin ecosystem. 🧑‍💻
CursorJack Lab is a hands-on scenario built around exactly that blind spot, an MCP-based compromise of a Cursor IDE install leading to multi-region cloud takeover and on-chain exfiltration.

Built for cloud security engineers who want to understand this attack surface before it shows up in their queue. ☁️

👉 Investigate Now: https://f.mtr.cool/dmkkuquxup

VPN logs are one of the fastest ways to spot compromised credentials.
Why? Because attackers don’t always exploit vulnerabilities… they log in. 🔓
Look for:
🔹 Impossible travel (geo anomalies)
🔹 Logins outside baseline hours.
🔹 New device fingerprints.

A valid VPN session ≠ a legitimate user.
👉 Check this Full VPN guide: https://f.mtr.cool/wngotkjsyl

👉 New case study released.
Topic: USB Device Alert Investigation on Corporate Endpoints. 💻

This is a full investigation playbook covering:
✦ Insider threat exfiltration detection
✦ USB-borne malware and HID emulation identification
✦ Evidence collection across EDR, Windows Event Logs, DLP, and SIEM
✦ Splunk and KQL query patterns
✦ Escalation path including Legal coordination

Written as working SOC documentation. No definitions, no theory, just the investigation workflow. 🕵️
🔗 https://f.mtr.cool/cejkaaoupb

SOC Simulator: USB Insider Threat Detection Practical SIEM queries for USB investigations using Splunk & Microsoft Sentinel KQL. Covers CrowdStrike telemetry, log correlation, and removable media threats.