console portfolio/siem-labs
source github/awesome-siem-labs
ACTIVEAwesome SIEM Practice Labs
splunk · elastic · curated from top cybersecurity platforms · always up to date
SIEM Type
Platform
Difficulty
Lab Index
| Lab Name | Platform | Difficulty | Pricing | SIEM | AD | |
|---|---|---|---|---|---|---|
| Spilled Bucket | BTLO | Easy | Subscription | Splunk | ❌ | Open ↗ |
| AWeSome | BTLO | Medium | Subscription | Splunk | ❌ | Open ↗ |
| DomainNance | BTLO | Medium | Subscription | Splunk | ✅ | Open ↗ |
| Nika-AD | BTLO | Medium | Subscription | Splunk | ✅ | Open ↗ |
| Splunk IT | BTLO | Easy | Subscription | Splunk | ✅ | Open ↗ |
| Drilldown | BTLO | Medium | Subscription | Splunk | ❌ | Open ↗ |
| Pikaboo | BTLO | Medium | Subscription | Splunk | ✅ | Open ↗ |
| MiddleMayhem | BTLO | Easy | Free | Splunk | ❌ | Open ↗ |
| Rotten Cloud | BTLO | Medium | Subscription | Splunk | ❌ | Open ↗ |
| Bad Import | BTLO | Medium | Subscription | Splunk | ❌ | Open ↗ |
| ShadowRoast | CyberDefenders | Medium | Subscription | Splunk | ✅ | Open ↗ |
| FalconEye | CyberDefenders | Medium | Subscription | Splunk | ✅ | Open ↗ |
| Boss Of The SOC v1 | CyberDefenders | Medium | Subscription | Splunk | ❌ | Open ↗ |
| Boss Of The SOC v2 | CyberDefenders | Hard | Subscription | Splunk | ❌ | Open ↗ |
| Boss Of The SOC v3 | CyberDefenders | Hard | Subscription | Splunk | ❌ | Open ↗ |
| AWSRaid | CyberDefenders | Easy | Subscription | Splunk | ❌ | Open ↗ |
| NerisBot | CyberDefenders | Easy | Subscription | Splunk | ❌ | Open ↗ |
| LNKTrap | CyberDefenders | Medium | Subscription | Splunk | ✅ | Open ↗ |
| TeamCity Exploit | CyberDefenders | Insane | Subscription | Splunk | ✅ | Open ↗ |
| Voldemort - APT41 | CyberDefenders | Hard | Subscription | Splunk | ❌ | Open ↗ |
| NetSupport RAT - TA569 | CyberDefenders | Medium | Subscription | Splunk | ✅ | Open ↗ |
| CredSnare - Angry Likho APT | CyberDefenders | Medium | Subscription | Splunk | ✅ | Open ↗ |
| Zoom Incident - Ignoble Scorpius APT | CyberDefenders | Insane | Subscription | Splunk | ✅ | Open ↗ |
| StarkTech Incident - APT41 | CyberDefenders | Hard | Subscription | Splunk | ✅ | Open ↗ |
| Nitrogen - Blackcat Ransomware | CyberDefenders | Medium | Subscription | Splunk | ✅ | Open ↗ |
| BlackSuit APT Breach | CyberDefenders | Hard | Subscription | Splunk | ✅ | Open ↗ |
| RansomHub | CyberDefenders | Hard | Subscription | Splunk | ✅ | Open ↗ |
| Latrodectus – LunarSpider | CyberDefenders | Hard | Subscription | Splunk | ✅ | Open ↗ |
| Raining Dinosaurs - Storm-2603 | CyberDefenders | Medium | Subscription | Splunk | ✅ | Open ↗ |
| Stolen Time - HiddenTear | CyberDefenders | Medium | Subscription | Splunk | ✅ | Open ↗ |
| Poisoned PyTorch | CyberDefenders | Medium | Subscription | Splunk | ✅ | Open ↗ |
| MarkShell - TA577 | CyberDefenders | Hard | Subscription | Splunk | ✅ | Open ↗ |
| ActiveMQ - LockBit Ransomware | CyberDefenders | Medium | Subscription | Splunk | — | Open ↗ |
| BreakOut-Daedalus | CyberDefenders | Hard | Subscription | Splunk | — | Open ↗ |
| Gh0stNet Intrusion | CyberDefenders | Hard | Subscription | Splunk | — | Open ↗ |
| ClawHavoc | CyberDefenders | Hard | Subscription | Splunk | — | Open ↗ |
| RansomedTrust - Lynx | CyberDefenders | Hard | Subscription | Splunk | — | Open ↗ |
| BlindSentry | CyberDefenders | Insane | Subscription | Splunk | — | Open ↗ |
| ClickFix - VodkaStealer | CyberDefenders | Medium | Subscription | Splunk | — | Open ↗ |
| GhostConnect - TA583 | CyberDefenders | Easy | Subscription | Splunk | — | Open ↗ |
| Benign | TryHackMe | Medium | Subscription | Splunk | ❌ | Open ↗ |
| PS Eclipse | TryHackMe | Medium | Subscription | Splunk | ❌ | Open ↗ |
| New Hire Old Artifacts | TryHackMe | Medium | Subscription | Splunk | ❌ | Open ↗ |
| Investigating with Splunk | TryHackMe | Medium | Subscription | Splunk | ❌ | Open ↗ |
| Conti | TryHackMe | Medium | Free | Splunk | ❌ | Open ↗ |
| Brains | TryHackMe | Easy | Subscription | Splunk | ❌ | Open ↗ |
| Splunk 2 | TryHackMe | Medium | Subscription | Splunk | ❌ | Open ↗ |
| Splunk 3 | TryHackMe | Medium | Subscription | Splunk | ❌ | Open ↗ |
| Fixit | TryHackMe | Medium | Subscription | Splunk | ❌ | Open ↗ |
| Volt Typhoon | TryHackMe | Medium | Free | Splunk | ✅ | Open ↗ |
| Incident Handling With Splunk | TryHackMe | Medium | Subscription | Splunk | — | Open ↗ |
| Alert Triage With Splunk | TryHackMe | Medium | Subscription | Splunk | — | Open ↗ |
| Zero Tolerance | TryHackMe | Medium | Subscription | Splunk | — | Open ↗ |
| The Crown Jewel | TryHackMe | Easy | Subscription | Splunk | — | Open ↗ |
| Detecting AD Credential Attacks | TryHackMe | Medium | Subscription | Splunk | ✅ | Open ↗ |
| Detecting AD Lateral Movement | TryHackMe | Medium | Subscription | Splunk | ✅ | Open ↗ |
| Web Attack Forensics - Drone Alone | TryHackMe | Medium | Free | Splunk | — | Open ↗ |
| SOC Alpha 1 | BTLO | Easy | Subscription | Elastic | ❌ | Open ↗ |
| SOC Alpha 2 | BTLO | Medium | Subscription | Elastic | ❌ | Open ↗ |
| SOC Alpha 3 | BTLO | Hard | Subscription | Elastic | ❌ | Open ↗ |
| Cozy Bear | BTLO | Hard | Subscription | Elastic | — | Open ↗ |
| Cozy Bear 2 | BTLO | Medium | Subscription | Elastic | ✅ | Open ↗ |
| PE | BTLO | Easy | Subscription | Elastic | ❌ | Open ↗ |
| Gothic Panda 2 | BTLO | Medium | Subscription | Elastic | — | Open ↗ |
| Defaced | BTLO | Easy | Subscription | Elastic | ❌ | Open ↗ |
| Rigged | BTLO | Medium | Subscription | Elastic | ❌ | Open ↗ |
| Peak | BTLO | Medium | Subscription | Elastic | ❌ | Open ↗ |
| Invoice | BTLO | Medium | Subscription | Elastic | ❌ | Open ↗ |
| Bada Breach | BTLO | Hard | Subscription | Elastic | ✅ | Open ↗ |
| Pathfinder's Mark | BTLO | Medium | Subscription | Elastic | ❌ | Open ↗ |
| Dumpster | BTLO | Hard | Subscription | Elastic | ✅ | Open ↗ |
| AzureHunt | CyberDefenders | Easy | Subscription | Elastic | ❌ | Open ↗ |
| ElasticCase | CyberDefenders | Medium | Subscription | Elastic | ❌ | Open ↗ |
| GitTheGate | CyberDefenders | Medium | Subscription | Elastic | ❌ | Open ↗ |
| PaloAltoRCE | CyberDefenders | Hard | Subscription | Elastic | ❌ | Open ↗ |
| HafinumAPT | CyberDefenders | Hard | Subscription | Elastic | ❌ | Open ↗ |
| LTE Fallen Wall | CyberDefenders | Hard | Subscription | Elastic | ❌ | Open ↗ |
| Maromafix Falldown - RansomHub | CyberDefenders | Hard | Subscription | Elastic | ✅ | Open ↗ |
| Maromalix Nightmare | CyberDefenders | Medium | Subscription | Elastic | — | Open ↗ |
| Slingshot | TryHackMe | Easy | Subscription | Elastic | ❌ | Open ↗ |
| ItsyBitsy | TryHackMe | Medium | Subscription | Elastic | ❌ | Open ↗ |
| Boogeyman 3 | TryHackMe | Medium | Subscription | Elastic | ✅ | Open ↗ |
| Hunt Me I: Payment Collectors | TryHackMe | Medium | Subscription | Elastic | ❌ | Open ↗ |
| Hunt Me II: Typo Squatters | TryHackMe | Medium | Subscription | Elastic | ✅ | Open ↗ |
| Alert Triage With Elastic | TryHackMe | Medium | Subscription | Elastic | — | Open ↗ |
| Detection Rules Development | TryHackMe | Medium | Free | Elastic | — | Open ↗ |
| Virus Vipers | XINTRA | Medium | Subscription | Elastic | — | Open ↗ |
| Assassin Kitty | XINTRA | Hard | Subscription | Elastic | ✅ | Open ↗ |
| Waifu University | XINTRA | Easy | Subscription | Elastic | ✅ | Open ↗ |
| Husky Corp | XINTRA | Medium | Subscription | Elastic | ✅ | Open ↗ |
| TechTonik Inc | XINTRA | Hard | Subscription | Elastic | — | Open ↗ |
| Airbuzzed | XINTRA | Medium | Subscription | Elastic | — | Open ↗ |
| Council of Tropical Affairs | XINTRA | Medium | Subscription | Elastic | ✅ | Open ↗ |
| Abu Jibal | XINTRA | Medium | Subscription | Elastic | ✅ | Open ↗ |
| AB Projekt Blue | XINTRA | Medium | Subscription | Elastic | ❌ | Open ↗ |
| Meow Islands | XINTRA | Hard | Subscription | Elastic | — | Open ↗ |
| NavalTech Systems | XINTRA | Medium | Subscription | Elastic | — | Open ↗ |
| Global Freight | XINTRA | Medium | Subscription | Elastic | — | Open ↗ |
| Acquisition | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| Pipe Dream | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| AD Maze | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| Qakbot | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| Blind Spot | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| Pwned 365 | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| Pivot | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| Under Pressure | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| Airgapped | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| Unassumed Breach | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| Volt Typhoon | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| Run of the Mill | Ace Responder | None | Free | Elastic | — | Open ↗ |
| Locked Up | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| Intune Infiltration | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| Dumpster Diving | Ace Responder | None | Subscription | Elastic | — | Open ↗ |
| BumbleSting | CyberDefenders | Medium | Subscription | Spl / Ela | ✅ | Open ↗ |
| GoldenSpray | CyberDefenders | Medium | Subscription | Spl / Ela | ✅ | Open ↗ |
| Kerberoasted | CyberDefenders | Medium | Subscription | Spl / Ela | ✅ | Open ↗ |
| T1197 | CyberDefenders | Medium | Subscription | Spl / Ela | ❌ | Open ↗ |
| Midnight RDP | CyberDefenders | Hard | Subscription | Spl / Ela | ✅ | Open ↗ |
| Ignoble Scorpius | CyberDefenders | Insane | Subscription | Spl / Ela | ✅ | Open ↗ |
| T1110–003 | CyberDefenders | Easy | Subscription | Spl / Ela | ❌ | Open ↗ |
| REvil | CyberDefenders | Easy | Subscription | Spl / Ela | ❌ | Open ↗ |
| Black Basta | CyberDefenders | Medium | Subscription | Spl / Ela | ✅ | Open ↗ |
| Perfect Survey | CyberDefenders | Medium | Subscription | Spl / Ela | ✅ | Open ↗ |
| Rhysida - Vice Society | CyberDefenders | Medium | Subscription | Spl / Ela | ✅ | Open ↗ |
| BlueSky Ransomware - Public Case #19208 | DFIR Labs | Easy | Pay per access | Spl / Ela | — | Open ↗ |
| ALPHV Ransomware - Public Case #24952 | DFIR Labs | Easy | Pay per access | Spl / Ela | ✅ | Open ↗ |
| A Truly Graceful Wipe Out - Public Case #21619 | DFIR Labs | Easy | Pay per access | Spl / Ela | ✅ | Open ↗ |
| NetSupport Intrusion Results in Domain Compromise - Public Case #19438 | DFIR Labs | Medium | Pay per access | Spl / Ela | ✅ | Open ↗ |
| Qbot Leads to Domain Compromise - Private Case #27101 | DFIR Labs | Medium | Pay per access | Spl / Ela | ✅ | Open ↗ |
| Dagon Locker Ransomware - Private Case #23825 | DFIR Labs | Hard | Pay per access | Spl / Ela | — | Open ↗ |
| LockBit Ransomware - Public Case #27244 | DFIR Labs | Medium | Pay per access | Spl / Ela | ✅ | Open ↗ |
| Backdoors and LockBit - Private Case #27138 | DFIR Labs | Easy | Pay per access | Spl / Ela | ✅ | Open ↗ |
| BlackSuit Ransomware - Public Case #29354 | DFIR Labs | Medium | Pay per access | Spl / Ela | ✅ | Open ↗ |
| Elpaco-Team Ransomware - Public Case #30043 | DFIR Labs | Medium | Pay per access | Spl / Ela | ✅ | Open ↗ |
| Mud In The Water - Private Case #29823 | DFIR Labs | Hard | Pay per access | Spl / Ela | — | Open ↗ |
| RansomHub Leads to Domain Compromise – Public Case #33490 | DFIR Labs | Hard | Pay per access | Spl / Ela | ✅ | Open ↗ |
| The Hive Ransomware Fail - Public Case #18364 | DFIR Labs | Easy | Pay per access | Spl / Ela | — | Open ↗ |
| The Nokoyawa Ransomware Intrusion - Public Case #18543 | DFIR Labs | Easy | Pay per access | Spl / Ela | — | Open ↗ |
| Specter's Domain Heist - Private Case #35218 | DFIR Labs | Hard | Pay per access | Spl / Ela | — | Open ↗ |
| The Lunar Tangled Malware Web - Public Case #28761 | DFIR Labs | Hard | Pay per access | Spl / Ela | ✅ | Open ↗ |
| A Contagious Interview - Private Case #38413 | DFIR Labs | Medium | Pay per access | Spl / Ela | — | Open ↗ |
| ClickFix leads to RomComRAT Domain Compromise - Private Case #35646 | DFIR Labs | Hard | Pay per access | Spl / Ela | — | Open ↗ |
| ClickFix leads to Tsundere Bot, Tunnels, RMM's and Double Theft - Private Case #39390 | DFIR Labs | Hard | Pay per access | Spl / Ela | — | Open ↗ |
Data fetched live from GitHub — always up to date
SOC · SIEM.LABS · CHICKEN0248 · ↩ OPERATOR.PROFILE