Skip to content

Bifract Labs

Labs for Bifract. Each lab is a log dataset with an intrusion in it. Follow the walkthrough step by step, or hunt on your own and check your answers.

Start lab 001 Get Bifract

Oct 27, 08:00 UTC: 5,575 eventsTue 27Oct 27, 09:00 UTC: 12,802 eventsOct 27, 10:00 UTC: 10,096 eventsOct 27, 11:00 UTC: 9,563 eventsOct 27, 12:00 UTC: 16,469 eventsOct 27, 13:00 UTC: 16,942 eventsOct 27, 14:00 UTC: 14,026 eventsOct 27, 15:00 UTC: 13,516 eventsOct 27, 16:00 UTC: 11,103 eventsOct 27, 17:00 UTC: 18,839 eventsOct 27, 18:00 UTC: 16,847 eventsOct 27, 19:00 UTC: 15,792 eventsOct 27, 20:00 UTC: 15,527 eventsOct 27, 21:00 UTC: 10,191 eventsOct 27, 22:00 UTC: 9,247 eventsOct 27, 23:00 UTC: 9,878 eventsOct 28, 00:00 UTC: 10,190 eventsWed 28Oct 28, 01:00 UTC: 9,842 eventsOct 28, 02:00 UTC: 11,873 eventsOct 28, 03:00 UTC: 9,868 eventsOct 28, 04:00 UTC: 11,693 eventsOct 28, 05:00 UTC: 10,467 eventsOct 28, 06:00 UTC: 9,471 eventsOct 28, 07:00 UTC: 9,852 eventsOct 28, 08:00 UTC: 17,655 eventsOct 28, 09:00 UTC: 16,192 eventsOct 28, 10:00 UTC: 9,593 eventsOct 28, 11:00 UTC: 9,800 eventsOct 28, 12:00 UTC: 11,342 eventsOct 28, 13:00 UTC: 15,469 eventsOct 28, 14:00 UTC: 13,271 eventsOct 28, 15:00 UTC: 13,951 eventsOct 28, 16:00 UTC: 11,318 eventsOct 28, 17:00 UTC: 15,236 eventsOct 28, 18:00 UTC: 14,684 eventsOct 28, 19:00 UTC: 16,181 eventsOct 28, 20:00 UTC: 14,471 eventsOct 28, 21:00 UTC: 10,987 eventsOct 28, 22:00 UTC: 9,463 eventsOct 28, 23:00 UTC: 10,048 eventsOct 29, 00:00 UTC: 10,164 eventsThu 29Oct 29, 01:00 UTC: 10,401 eventsOct 29, 02:00 UTC: 12,302 eventsOct 29, 03:00 UTC: 9,899 eventsOct 29, 04:00 UTC: 10,176 eventsOct 29, 05:00 UTC: 10,269 eventsOct 29, 06:00 UTC: 9,290 eventsOct 29, 07:00 UTC: 10,054 eventsOct 29, 08:00 UTC: 10,609 eventsOct 29, 09:00 UTC: 11,621 eventsOct 29, 10:00 UTC: 9,780 eventsOct 29, 11:00 UTC: 9,660 eventsOct 29, 12:00 UTC: 17,998 eventsOct 29, 13:00 UTC: 13,952 eventsOct 29, 14:00 UTC: 47,020 eventsOct 29, 15:00 UTC: 64,959 eventsOct 29, 16:00 UTC: 61,558 eventsOct 29, 17:00 UTC: 63,268 eventsOct 29, 18:00 UTC: 63,044 eventsOct 29, 19:00 UTC: 62,745 eventsOct 29, 20:00 UTC: 62,566 eventsOct 29, 21:00 UTC: 61,282 eventsOct 29, 22:00 UTC: 59,700 eventsOct 29, 23:00 UTC: 59,879 eventsOct 30, 00:00 UTC: 60,525 eventsFri 30Oct 30, 01:00 UTC: 60,990 eventsOct 30, 02:00 UTC: 62,052 eventsOct 30, 03:00 UTC: 59,922 eventsOct 30, 04:00 UTC: 60,316 eventsOct 30, 05:00 UTC: 60,922 eventsOct 30, 06:00 UTC: 60,114 eventsOct 30, 07:00 UTC: 61,812 eventsOct 30, 08:00 UTC: 61,349 eventsOct 30, 09:00 UTC: 61,335 eventsOct 30, 10:00 UTC: 60,155 eventsOct 30, 11:00 UTC: 60,114 eventsOct 30, 12:00 UTC: 63,270 eventsOct 30, 13:00 UTC: 28,749 events
Lab 001: events per hour, Oct 27 to 30, 2026 (UTC)

Labs

Lab 001

Meridian workstation intrusion

A user pastes a command they were told to run, and an attacker takes it from there.

  • Sysmon
  • Windows events
  • Zeek
  • 2.08M events
  • 5 hosts
  • 31 questions

Open lab

No Bifract yet? You can run lab 001 in Codespaces with nothing to install.