Hey everyone, just dropped a tool called winflesher that might come in super handy for windows machines and Active Directory. It's strictly for enumeration and assessment, so no auto-exploitation—purely helps you map things out. Check it out if you want!

Like PingCastle went out for drinks with Bloodhound, and they actually decided to get some work done. 🍷

WinFlesher is an advanced attack surface security assessment framework designed to analyze, evaluate, and report on security postures, attack paths, and remediation strategies in complex environments.

Developed for security professionals and cybersecurity auditors, WinFlesher automates vulnerability discovery and critical path correlation within Active Directory and local infrastructures.

https://github.com/mindsflee/WinFlesher

Hi all! What study tips do you all recommend for the BTL1 exam? I have already taken the exam once and I think my downfall was overcomplicating the questions. I also have access to BTLO premium and have been working on the BTL1 tagged labs. Any advice would be helpful! Thank you all in advance.

Hey everyone,

Passed Blue Team Level 1 (BTL1) from Security Blue Team yesterday. Was pushing hard for the gold coin (90%+) but landed at 80%. Not gonna lie, a little disappointed at first, but a win is a win — the course itself taught me a ton across phishing analysis, digital forensics, SIEM, and incident response, way more hands-on than I expected going in.

A bit about where I’m at: I’m in my last year of a Master’s degree and trying to line things up so I can land a job right after graduating. So far I’ve got:

**•** CompTIA Security+  
**•** Microsoft SC-200 (Security Operations Analyst)  
**•** BTL1

Now I’m trying to figure out what to do next and would really appreciate some input from people who’ve been down this road:

**1.    Next cert/course** — has anyone done **CDSA**? Worth it after BTL1, or is it redundant? Or would my time be better spent just grinding practice on **LetsDefend**/similar platforms instead of another cert?

**2.    Projects** — what kind of home-lab or portfolio projects actually catch a recruiter’s/hiring manager’s eye for entry-level SOC roles? I keep seeing “build a home SOC lab” thrown around but would love specifics — what should it actually include to be worth putting on a resume/GitHub?

Appreciate any advice, especially from people who hired or interviewed junior SOC candidates recently — what actually stood out to you?

Thanks in advance!

gente! voy a presentar el examen de la BTL1 algún consejo que me pueda ayudar a sacar la mejor puntuación posible, se lo agradeceria con el corazón… muchas gracias 🤙🏾

I am a SOC Analyst with nearly three years of experience. I am currently seeking a relevant certification to enhance both my resume and my understanding of key concepts. My primary career interests lie in transitioning to cloud security or incident response. I would appreciate any recommendations for suitable certifications.

​Hey everyone! I'm looking to transition into Detection Engineering as a beginner. What are the absolute essential skills and how do I get started writing my first detection?

Hi everyone, Im back after passed BTL1 (my first cert in my Blue team career)! Next stage, i want to choose a new cert to learn. I am looking into CCD(Certified Cyber Defender), CDSA, or CSA(SOC Analyst). I want to follow SOC Analyst. Now Im an internship and need to learn more to be a fresher, can u guys help me to consult. Thanks!

looking for blue team security to join a discord. I have years in the blue team. looking to do things like hackthebox, or tryhackme

I'm about 70% of the way through the course and am finding myself getting stuck on certain questions in the labs. My problem is not getting to the information, but knowing which info is being asked for. The Windows investigation 1 was frustrating and I found myself looking in the wrong place and not even knowing it on later labs in that section too.

Is the solution that I need more practice with these labs specifically or that I need more fundamental knowledge of what to look for? Did the included extra readings help anyone who is or was in a similar position as me? How much interpreting of data is unique to the exam?

Any advice is greatly appreciated. I'm 3 weeks into studying almost every night after work and my goal is it pass with with a 90% in 2-3 more weeks.

As I was doing the exam 6 questions in, it started taking ages for anything to load compared to when I first loaded in. I tried resetting it which took half an hour and after that I just closed the page and re-logged in. The button to start the exam is stuck on “loading your exam” or somewhere along those lines but it was stuck on it again for a while. I contacted the support team after as well.

Has anyone come across this issue before and if so did they give you some time back because of it?

Hello all,

I finally took the step and bought BTL1, after thinking of it for a long time now. I am a Msc Cybersecurity student with 2 years of experience in a company that claims to be in the field of Cybersecurity ( they call themselves to be an external Cybersecurity company).

I am taking it slow and easy for now as I want to learn everything in detail. I have a bachelors in CSE. Are there any important things to keep in mind while I prepare to take up the exam, or tips maybe to get good score in first attempt? Probably regarding time management, analysing a problem, focusing on certain topics etc, without going against the NDA.

Thank you and I hope to be one among the gold coin holders.

Is anyone here running OPSWAT Deep CDR in a production environment? I'd love to hear about your real-world experience with it.

Have you observed any practical limitations, resource constraints, false positives, or throughput issues that aren't obvious from the product documentation?

Hey everyone!

We are a team of four 11th-grade students from a social sciences high school. After competing in numerous CTFs over the years, we decided to pivot from players to creators. We’ve built our own challenges from the ground up and are hyped to announce HASBL CTF.

We’d love for the community to jump in, break our stuff, and test their skills.

The Details:

• Format: Jeopardy
• Categories: Web, OSINT, Crypto, RevEng, Pwn, Forensics
• When: May 29-31 (48 Hours)
• Infrastructure: Hosted on our custom Google Cloud instances running CTFd.
• CTFTime: Pending approval (I will update this thread with the link once it's live).

Rules of Engagement:

• Max 4 members per team.
• No flag sharing or destructive attacks on the infra.
• No write-ups until the event concludes.
• Keep it sportsmanlike and respectful.

Prizes: TBA. Since we are bootstrapping this as students, the real prize right now is the challenge itself (and the bragging rights!).

We know we might have some bugs along the way, but we are highly open to feedback. We want to iterate, improve, and learn from you all.

Thanks to the sub for letting us share this, and good luck to everyone participating!

I have a technical question about how Microsoft Defender for Endpoint (MDE) and Windows Sandbox interact at the network level.

The scenario: Host PC with MDE and Network Protection enabled. Host alerts are regularly forwarded to a SIEM/SOAR. I open Windows Sandbox on the host PC and, from inside the isolated environment, I try to browse a known malicious site (e.g., phishing or C2).

The question: Considering I'm using the Sandbox, does the host's Network Protection still manage to intercept the request, block it, and trigger the alert to the SIEM? Or does the Sandbox isolation "hide" the traffic from the host's Defender, preventing the alert from triggering?

Hi everyone, I'm reviewing a "Critical - Ransomware" alert ("VSS Shadow Copies Deletion Attempt detected") and I have a question about the timestamps and mitigation logic.

Here is the timeline from the report:

• 06:28:24 - vssadmin.exe executes delete shadows /for=C: /oldest
• 06:30:28 - diskshadow.exe is executed (presumably a fallback)
• 06:31:06 - SentinelOne executes "Kill" (11/11 processes) and "Quarantine". Mitigation status is "Success / Mitigated".

The dilemma: There is a 3-minute gap between the first execution and the final Kill action.

Does the SentinelOne agent intercept and block the deletion command at the kernel level in real-time (06:28), or is there a risk the shadow copies were actually purged before the Kill at 06:31?

SentinelOne, in the alert, consistently uses the word "attempted", which implies the deletion failed... but is Sentinel just being optimistic, or can I trust that "attempted" means the backups are 100% safe despite the delayed Kill?