My 10-Week HTB Sherlocks Blue Team Roadmap

Roadmap

This is my current HTB Sherlocks roadmap for building a practical SOC / Blue Team foundation.

The point is not to collect solves. The point is to get better at reading evidence, building timelines, explaining attacker actions, and writing notes that can survive an interview.

Week 1 - Core Investigation Foundation

Lab	Area	Level	Practice
Brutus	DFIR	Very Easy	Linux auth.log, wtmp, SSH brute force, successful login, persistence, sudo activity.
Unit42	DFIR	Very Easy	Sysmon Event IDs, process tree, DNS queries, network connection, timestomping.
BFT	DFIR	Very Easy	$MFT, MFTECmd, Timeline Explorer, Zone.Identifier, malicious file recovery.
Telly	SOC	Very Easy	Basic SOC alert triage and case handling.

Week 2 - PCAP, AD Intro, Malware, Threat Intel

Lab	Area	Level	Practice
Meerkat	SOC	Easy	PCAP, Suricata alerts, credential stuffing, CVE exploitation, web app compromise.
Campfire-1	DFIR	Very Easy	Kerberoasting detection, Event ID 4769, Rubeus, PowerView, AD log analysis.
Subatomic	Malware Analysis	Medium	Electron malware, fake installer, Discord hijacking, browser data theft, static triage.
ElectricBreeze-1	Threat Intelligence	Very Easy	Threat intel pivoting, campaign context, external indicator enrichment.

Week 3 - Windows Logs, AD Network Attack, Web Compromise, Cloud

Lab	Area	Level	Practice
LogJammer	DFIR	Easy	Windows Security, System, Defender, Firewall, PowerShell logs, scheduled tasks.
Noxious	SOC	Very Easy	LLMNR poisoning, rogue device detection, AD network recon.
Bumblebee	DFIR	Easy	phpBB SQLite database, web logs, web shell and admin compromise analysis.
Nubilum-1	Cloud	Medium	AWS CloudTrail, compromised EC2, exposed S3, cloud IR, PoshC2.

Week 4 - AS-REP, Fake CAPTCHA, PE Triage, Insider Timeline

Lab	Area	Level	Practice
Campfire-2	DFIR	Very Easy	AS-REP roasting, Event ID 4768, vulnerable AD account detection.
Pikaptcha	DFIR	Easy	Fake CAPTCHA, PowerShell Run dialog abuse, registry artifacts, PCAP correlation.
Heartbreaker-Continuum	Malware Analysis	Easy	PEStudio, Ghidra, VirusTotal, MITRE ATT&CK mapping.
Constellation	Threat Intelligence	Medium	Insider threat, URL forensics, Discord and Google timeline reconstruction.

Week 5 - NTLM Relay, Endpoint Artifacts, Malware, GCP Cloud

Lab	Area	Level	Practice
Reaper	DFIR	Very Easy	NTLM relay, LLMNR response poisoning, Windows Security Log correlation.
Noted	DFIR	Easy	Notepad++ artifacts, AppData, data extortion trail.
SalineBreeze-2	Malware Analysis	Easy	Malware triage, IoC extraction, breach investigation.
MisCloud	Cloud	Medium	GCP breach, Gitea vulnerability, cloud misconfiguration.

Week 6 - AD Credential Theft, SOC Case, Malware Medium, Email Forensics

Lab	Area	Level	Practice
CrownJewel-1	DFIR	Very Easy	NTDS.dit dump, Volume Shadow Copy, AD enumeration.
Cuidado	SOC	Easy	SOC alert investigation and correlation.
SneakyKeys	Malware Analysis	Medium	Medium malware triage, keylogging and persistence-style reasoning.
TickTock	DFIR	Medium	Spear-phishing investigation, email forensics, timeline reconstruction.

Week 7 - Lateral Movement, Exfiltration, Memory, Cloud Follow-up

Lab	Area	Level	Practice
CrownJewel-2	DFIR	Very Easy	Lateral movement detection, Pass-the-Hash.
Litter	SOC	Easy	Network forensics, data exfiltration indicators.
Recollection	DFIR	Easy	Memory forensics, Volatility, suspicious process analysis.
Nubilum2	Cloud	Easy	Cloud follow-up investigation, identity and resource reasoning.

Week 8 - Threat Hunting, Active TI, Malware Module, Cloud Campaign

Lab	Area	Level	Practice
Tracer	DFIR	Easy	PsExec detection, SOC alert investigation, lateral movement.
KitsuneHook	Threat Intelligence	Easy	Active threat intel practice, newer challenge, less writeup dependency.
Malevolent ModMaker	Malware Analysis	Medium	Custom malware module analysis.
OpTinselTrace24-3: Blizzard Breakdown	Cloud	Medium	Cloud investigation in a campaign-style case.

Week 9 - APT, Memory/Event Correlation, Hard Network, Hard Malware

Lab	Area	Level	Practice
APTNightmare	DFIR	Medium	APT-style investigation, multi-stage incident reconstruction.
OpTinselTrace-3	DFIR	Medium	Volatility3, Chainsaw, memory plus event log correlation.
ProcNet	DFIR	Hard	Network traffic analysis, malware investigation, API data capture.
Lockpick3.0	Malware Analysis	Hard	Hard ransomware and malware continuation after Lockpick2.0.

Week 10 - Final Capstone

Lab	Area	Level	Practice
OpTinselTrace-4	DFIR	Easy	Data exfiltration, C2 communication analysis.
OpTinselTrace-5	DFIR	Hard	Full APT chain reconstruction and final reporting.
Lockpick4.0	Malware Analysis	Insane	Ransomware/malware capstone, deeper encryption and key recovery reasoning.
LogForge	DFIR	Medium	Blind final exam style practice: log correlation without leaning on public writeups.

Reading Layer

Priority	Topic	Read with	Link
Must	C2 communication detection	Meerkat, Litter, ProcNet, OpTinselTrace-4, APTNightmare	HTB
Must	LLMNR poisoning detection	Noxious, Reaper, Campfire-1, Campfire-2	HTB
Must	SmartScreen logs for execution evidence	Pikaptcha, Noted, LogJammer	HTB
Must	PsExec lateral movement artifacts	Tracer, CrownJewel-2, APTNightmare	HTB
Must	AWS CloudTrail log analysis	Nubilum-1, Nubilum2, MisCloud, OpTinselTrace24-3	HTB
Strong	Windows event logs for incident responders	Unit42, LogJammer, Campfire-1, Campfire-2, Reaper	HTB
Strong	Incident response report template	All labs, especially Week 4 onward	HTB
Strong	Network traffic analysis	Meerkat, Litter, Noxious, Reaper, ProcNet	HTB
Strong	Volatility and memory forensics	Recollection, OpTinselTrace-3, APTNightmare	HTB
Strong	Anti-forensics techniques	BFT, Unit42, Noted, APTNightmare, OpTinselTrace	HTB

Optional career and vocabulary reads

Topic	When I read it	Link
SOC onboarding plan	Before applying or interviewing	HTB
SOC analyst interview questions	After Weeks 2, 4, 8, and 10	HTB
SOC analyst skill map	Week 1 or before CV work	HTB
Blue team job direction	Before role mapping	HTB
Weekly SOC team habits	When thinking about real SOC workflow	HTB
Cloud weakness context	Before cloud weeks	HTB
USB attack detection	Optional endpoint add-on	HTB
Red team tool context	Optional attacker-tool vocabulary	CrackTheLab

Terminology Reference

The glossary is intentionally grouped so I can review only the terms related to the lab I am working on.

Investigation workflow terms

Term	Short explanation
SOC	Security Operations Center. A team that monitors alerts, investigates suspicious events, classifies true positives and false positives, and escalates when needed.
DFIR	Digital Forensics and Incident Response. A discipline focused on collecting evidence, analyzing artifacts, building timelines, and handling incidents.
Purple Team	A learning or operational model that combines Red Team and Blue Team work: understanding what attackers do so detections and responses can improve.
IoC	Indicator of Compromise. A sign of compromise such as an IP address, domain, hash, file path, username, process, or registry key.
MITRE ATT&CK	A knowledge base for mapping attacker behavior to tactics and techniques, such as credential access, lateral movement, and exfiltration.
Containment	The step that stops an incident from spreading: isolate hosts, disable accounts, revoke keys, block IoCs, and preserve evidence.
Timeline	An ordered sequence of timestamps used to answer what happened first, which user or host was affected, and what the attacker did next.
Evidence stacking	Avoid relying on a single artifact. For example, to prove execution, cross-check Sysmon, Prefetch, LNK, SmartScreen, and ShimCache.
SIEM	A platform that collects logs and alerts, such as Splunk, Sentinel, or Elastic. It is used for searching, correlation, detection, and triage.
EDR	Endpoint Detection and Response. An endpoint agent that exposes process, file, network, command-line, and response data, such as host isolation actions.

Windows forensic artifacts

Term	Short explanation
Sysmon	A Windows telemetry tool that records process creation, network connections, DNS queries, file creation, and registry events. It is very important in DFIR.
Event ID	The identifier for a Windows event. For example, 4769 is related to Kerberos service tickets, and 4768 is related to AS-REQ/AS-REP activity.
PowerShell 4104	The Event ID for PowerShell Script Block Logging. It is useful when an attacker runs scripts or obfuscated commands.
Prefetch	A Windows artifact showing that a program ran, recent execution times, and related files. It is used to help prove execution.
ShimCache / AppCompatCache	A Windows artifact that stores application compatibility traces. It can help prove that a file existed or was processed by the system.
LNK / Jump List / RecentDocs	User activity artifacts. They can show which files a user opened, which shortcuts were created, and which files appeared recently.
SmartScreen logs	Windows SmartScreen logs that can help prove an app or file was opened, or that a user interacted with a suspicious file.
$MFT	The NTFS Master File Table. It contains file and folder metadata such as timestamps, paths, sizes, and records. It is powerful for file-system timelines.
USN Journal	The NTFS change journal. It records file changes such as create, delete, rename, and overwrite operations. It is often used to trace lateral movement or tool execution.
Zone.Identifier	An Alternate Data Stream showing that a file came from the Internet zone. It is useful when investigating downloaded files or phishing attachments.

Network, C2, and Active Directory terms

Term	Short explanation
PCAP	Packet capture. A file containing network packets for analyzing traffic, protocols, request/response flows, beaconing, C2, or exfiltration.
Suricata	An IDS/IPS engine that generates alerts from network traffic. In SOC labs, Suricata alerts are often the starting point for pivoting into PCAP analysis.
C2	Command and Control. The channel attackers use to send commands, receive output, deploy payloads, maintain access, or exfiltrate data.
Beaconing	A repeated connection pattern at a regular interval. It is often used to detect C2 when a host calls out consistently.
DNS tunneling	A technique that hides data or commands inside DNS queries and responses to evade traditional detection.
DGA	Domain Generation Algorithm. Malware generates many domains to locate a C2 server, making blocklists harder to maintain.
LLMNR	Link-Local Multicast Name Resolution. A Windows protocol used to query hostnames on a LAN when DNS cannot resolve them. It uses UDP 5355.
NBT-NS	NetBIOS Name Service. An older protocol for resolving NetBIOS names on a LAN. It uses UDP 137 and is often abused alongside LLMNR.
NetNTLMv2	A challenge-response hash sent by Windows during NTLM authentication. Attackers can capture it and crack it offline or relay it.
NTLM relay	An attack where the attacker forwards a victim’s NTLM authentication to another service to log in as the victim, often involving SMB or LDAP.
SMB signing	A mechanism that signs SMB messages to reduce relay risk. If it is not enforced, NTLM relay is easier to perform.
Kerberoasting	An attack that requests a Kerberos service ticket for an SPN account and cracks it offline to recover the service account password.
AS-REP roasting	An attack targeting users without Kerberos pre-authentication enabled, allowing the attacker to obtain an AS-REP and crack it offline.
Rubeus	A common tool for Kerberos abuse, including Kerberoasting, AS-REP roasting, and ticket manipulation.
PowerView	A PowerShell tool used to enumerate Active Directory users, groups, sessions, ACLs, SPNs, and trusts.
NTDS.dit	The Active Directory database containing domain data and password hashes. A dump of this file is a serious incident.
Volume Shadow Copy	A Windows snapshot mechanism. Attackers can abuse it to copy locked files such as NTDS.dit.
Pass-the-Hash	A lateral movement technique that uses an NTLM hash to authenticate without needing the plaintext password.
PsExec	A Sysinternals tool for remote execution through SMB and service creation. It is a legitimate admin tool but is often abused for lateral movement.
Named pipe	An IPC mechanism on Windows. Some remote execution, C2, and lateral movement tools leave named pipe artifacts.

Cloud, web, malware, and memory terms

Term	Short explanation
CloudTrail	AWS audit logs for API activity from the console, CLI, and SDKs. They are used to investigate IAM abuse, EC2, S3, and access key activity.
EC2 / S3	EC2 is AWS compute infrastructure; S3 is object storage. Both services commonly appear in cloud incident response cases.
Web shell	A file or script on a web server that allows an attacker to run commands or manage the server remotely.
SQLite	A lightweight file-based database. It is often found in application artifacts, web artifacts, browser data, and web compromise labs.
PE file	A Windows executable format such as .exe or .dll. Malware triage often starts with PE metadata, strings, and imports.
PEStudio	A static triage tool for PE files, covering imports, strings, indicators, entropy, and suspicious metadata.
Ghidra	A reverse engineering tool for reading decompiled code, functions, string references, and malware logic.
VirusTotal	A service for looking up hashes, files, domains, and IP addresses to review detections, relations, community notes, and threat context.
Volatility	A memory forensics framework for analyzing RAM dumps, including processes, network connections, command lines, and injected code.
Chainsaw	A tool for hunting Windows Event Logs with Sigma rules or keyword logic. It is often used to quickly filter suspicious events.
Exfiltration	The act of moving data out of a victim environment. Evidence can appear in network traffic, cloud logs, archive files, or upload events.
Threat Intelligence	External context about IPs, domains, hashes, campaigns, TTPs, malware families, or actors used to enrich an investigation.

By the end, I want clean notes, real evidence, detection ideas, containment steps, and short interview-ready explanations.