Completed Case Study
PHANTOM CTI CTF: Supply Chain Incident Investigation
A Guardian Foundry / Level Effect cyber threat intelligence scenario focused on a simulated npm supply-chain compromise, CI/CD runner exposure, credential theft, exfiltration, and detection engineering.
Objective
Investigate a compromised dependency path, identify the malicious package version, document IOCs, explain the kill chain, and produce remediation and detection content for portfolio/interview discussion.
Work performed
Reviewed npm lockfile changes, CI/CD logs, deobfuscation notes, proxy logs, and GitHub audit evidence. Built evidence around package execution, Bun staging, exfiltration traffic, GitHub repository creation, and affected credentials.
Skills demonstrated
Supply-chain incident analysis, IOC documentation, MITRE ATT&CK mapping, YARA/Sigma/Snort-style detections, KQL/PowerShell threat hunting, remediation planning, and executive reporting.
Outcome
Produced a complete incident report with executive summary, timeline, indicators, technical analysis, remediation recommendations, detection content, and lessons learned.