Placing 7th of 192 in a DFIR CTF

Placed 7th out of 192 participants, top 4%, in a DFIR CTF built around the full Cyber Kill Chain, from initial access through to impact.

Approach

Worked through 42 flags spanning every stage of the kill chain. Most of the hunting happened in Microsoft Defender using KQL, correlating endpoint artifacts against Windows event logs to work out what actually happened instead of guessing from a single log source.

What it actually tested

The harder flags weren’t isolated indicators. They needed a full timeline: what ran, what it touched, what it talked to, and in what order. Reconstructing that end to end, across artifacts that don’t naturally line up, was most of the real work.

Full notes and artifacts are in the repo linked above.