DFIR investigation labs in your browser. One question per stage; the ATT&CK technique is revealed after the finding.
A sister's PC crashed mid-session and her family recovered the memory image. Eight stages walking the ATT&CK kill chain — investigate, then map your findings.
This site works on iOS Safari and Android Chrome. For the cleanest experience, after opening a lab, use your browser's Add to Home Screen (Safari Share menu / Chrome menu → Install app) — the CTF then runs fullscreen offline like a native app.
The labs in this pack were generated by a Claude Code skill called ctf-builder that converts forensic artefacts (memory images, disk images, pcap, EVTX corpus) into ATT&CK-organised CTFs with three deliverables — interactive game, DFIR report, and analyst training guide. Grab the skill from the repo.
The DFIR challenges referenced here derive from publicly available CTFs created by their original authors. The CTF wrapper, ATT&CK kill-chain methodology, analyst training guides, and ctf-builder skill in this repository are derivative educational content released under MIT.
The Black Window Case — memory image and case scenario from stuxnet999/MemLabs Lab 1 · github.com/stuxnet999/MemLabs/tree/master/Lab%201