Advent of Cyber 2025 Full Walkthrough

Let’s be real for a second: Anyone can follow a PDF to get a badge.

If you rushed through Advent of Cyber 2025 just to keep your streak alive, you likely missed the actual tradecraft hidden in the daily tasks. The value isn't in the green "Correct" banner; it's in understanding why a Docker socket mount is a critical vulnerability or how to manually de-obfuscate a PowerShell payload when CyberChef isn't enough.

We didn't just write a walkthrough; we wrote a technical breakdown of the entire event. We stripped away the gamification and focused purely on the Blue Team ops, Red Team pivots, and Forensic analysis required to actually understand what was happening under the hood.

We’ve split the full analysis into two parts. Here is what we are dissecting:

Part 1: The Foundation & The Pivot

Phishing Analysis: Why modern filters fail against Punycode and localized HTML attachments.
YARA Logic: Moving beyond simple string matching to Regex-based threat hunting.
The Docker Escape: A step-by-step breakdown of abusing docker.sock to go from container to host root.
Splunk Hunting: The exact Sysmon queries needed to trace a Command Injection attack from web logs to process spawning.

Part 2: Advanced Tradecraft & Forensics

Registry Forensics: How to manually reconstruct a malware infection timeline using UserAssist, Run keys, and Uninstall hives without relying on automated tools.
Deobfuscation: A masterclass in reversing XOR-encrypted PowerShell payloads and identifying C2 beacons.
OT/ICS Security: Hacking the Modbus protocol directly with Python (bypassing the HMI) to defuse a logic bomb in a physical control system.