.png)
ultimatro
TTP Terminator
445 / 12314 XP to level 88
*Rankings computed based on core modules (184995 pts).
Joined in November, 2024
ultimatro earned 31 badges
Download Your Certificate!
You've completed games and earned badges! Click on any badge below to view and download your certificate!
Inside Encryptodera
This analyst investigated an easy-level insider threat scenario by identifying suspicious employee activities, analyzing internal communications, and tracking unauthorized data transfers. They used Kusto Query Language (KQL) to analyze network flows and identify abnormal data movement to build and insider-threat profile.
Issued on: Dec 09, 2024
Scholomance
This analyst completed the "Scholomance" module, which focused on threat hunting with a threat intelligence-driven investigation. Using Kusto Query Language (KQL), they reinforced their skills in threat detection, anomaly identification, and data correlation.
Issued on: Dec 09, 2024
Virustotal Fundamentals
This analyst completed the "VirusTotal Fundamentals" module, which focused on using VirusTotal for comprehensive threat analysis. They demonstrated the ability to pivot around datasets, utilizing file hashes, domains, and IP addresses to uncover and correlate threats. This exercise reinforced their skills in leveraging VirusTotal's capabilities for detecting malicious activity and understanding the interconnections between various threat indicators.
Issued on: Dec 09, 2024
Azure Crest
This analyst successfully investigated a ransomware attack against a hospital. They demonstrated the ability to pivot around datasets using Kusto Query Language (KQL) to uncover the risks associated with prioritizing cost over security. This exercise reinforced skills in identifying vulnerabilities and understanding the broader implications of inadequate security measures in a healthcare context.
Issued on: Dec 09, 2024
World Domination Nation
This analyst completed the "World Domination Nation" module, investigating a sophisticated cyber attack on WDN Consulting. They used Kusto Query Language (KQL) in an investigation that covered lateral movement, credential dumping, system configuration modifications, and full domain compromise. This exercise reinforced their ability to effectively detect, analyze, and respond to complex cyber threats.
Issued on: Dec 10, 2024
Spooky Sweets
This analyst completed the "Spooky Sweets" module, investigating the staging and compressing of files for exfiltration of intellectual property. Skills gained include identifying early indicators, mitigating damage, and enhancing detection. This exercise highlighted their ability to respond to sophisticated cyber intrusions by leveraging knowledge of attacker behavior and TTPs.
Issued on: Dec 10, 2024
Sunlands ☀️🚀🧑🚀
This analyst investigated a sophisticated cyber attack on the Sunlands Aeronautics and Space Administration (SASA). They demonstrated advanced skills in detecting phishing attacks, analyzing malicious file downloads, and uncovering command and control infrastructure and persistence mechanisms. This exercise showcased their ability to respond to advanced cyber threats using threat actor tactics, techniques, and procedures (TTPs).
Issued on: Dec 10, 2024
HHC2024
This analyst successfully investigated a complex series of challenges in the "The Great Elf Conflict" for the 2024 SANS Holiday Hack Challenge. Leveraging Kusto Queries to guide their investigation, demonstrating skills in leveraging advanced tools and integrating threat data to uncover and understand security threats.
Issued on: Nov 21, 2024
Rap Beef
This analyst investigated a themed scenario involving rival hip-hop artists. They used key cybersecurity skills to identify suspicious communications and activities, analyzing internal messages to track unauthorized exchanges and uncover patterns. This exercise reinforced critical skills in data analysis, threat detection, and the application of cybersecurity principles in unconventional contexts.
Issued on: Nov 25, 2024
Valdorian Times
This analyst investigated an email phishing attack in Valdoria that uncovered a politically motivated influence campaign. Using Kusto Query Language (KQL), they analyzed employee roles, email communications, and computer process events, revealing evidence of data exfiltration and manipulation. This exercise reinforced skill in querying data and understanding data integrity within a cybersecurity context.
Issued on: Nov 25, 2024
Frognado In Valdoria
This analyst successfully investigated a hacktivist intrusion on FramtidX system. Through their use of Kusto Query Language (KQL), they discovered how the intruders managed to deface the company’s website and internal documents. They followed the activities of the threat actor, from reconnaissance to exfiltration, and uncovered the use of an internal account to further their compromise.
Issued on: Nov 28, 2024
AzureCrest
This analyst investigated a ransomware attack, where cost-cutting measures led to a single point of failure in their systems. This exercise highlighted the risks associated with prioritizing cost over security and reinforced skills in identifying vulnerabilities and understanding the broader implications of inadequate security measures in a healthcare context.
Issued on: Nov 30, 2024
.png)
Solvi Systems
This analyst investigated a cybersecurity incident at Solvi Systems by identifying an attempted XSS attack and tracking a phishing email campaign. Using Kusto Query Language (KQL), they uncovered the threat actor’s reconnaissance efforts, system compromises, and malware activities, providing critical insights for enhancing security measures.
Issued on: Nov 30, 2024
.png)
Titan Shield
This analyst successfully investigated two highly sophisticated cyberattacks against TitanShield’s sensitive projects, demonstrating advanced investigative skills in identifying social engineering tactics, malicious file execution, and data exfiltration strategies. Using Kusto Query Language (KQL), they unraveled Moonstone Sleet's phishing campaign targeting Project Omega and Crimson Sandstorm’s romance scheme aimed at harvesting critical system and user information. This exercise reinforced skills in threat actor profiling, recognizing social engineering-based reconnaissance on social media, and assessing the broader security implications of protecting intellectual property in a high-stakes defense context.
Issued on: Nov 30, 2024
Krusty Krab
This analyst completed the "Krusty Krab" module, investigating a phishing attack and data exfiltration. They used Kusto Query Language (KQL) to analyze email and network logs, revealing the use of deceptive email addresses and malicious domains. This exercise emphasized their ability to pivot and connect malicious domains to threat actor behavior, showcasing their proficiency in threat detection and analysis.
Issued on: Dec 04, 2024
Jojo's Hospital
This analyst completed the JoJo's Hospital module, investigating a cyber attack involving an Initial Access Broker and a Ransomware-as-a-Service (RaaS) operation. They demonstrated skills in detecting phishing and malvertising tactics, tracing unauthorized network access, understanding hacker collaboration, and analyzing ransomware activities.
Issued on: Dec 04, 2024
HopsNStuff
This analyst completed the "HopsNStuff" module, investigating a cyber attack through the analysis of endpoint process events and command-line activities. They demonstrated skills in identifying anomalous file behavior by using Kusto Query Language (KQL) to uncover malicious activities. The investigation highlighted their ability to analyze and deobfuscate malicious PowerShell commands, effectively identifying and responding to data exfiltration techniques.
Issued on: Dec 04, 2024
Envolve Labs
This analyst completed the "Envolve Labs" module. They demonstrated skills in using Kusto Query Language (KQL) in their investigation that included identifying phishing campaigns, analyzing command-line activities, and uncovering credential theft and data exfiltration. They also learned to cluster and attribute attacks to specific threat actors, connecting malicious domains and email addresses to threat actor behavior.
Issued on: Dec 02, 2024
Castle & Sand
This analyst investigated an easy-level ransomware scenario by identifying adversaries' reconnaissance activities, analyzing themed phishing emails, and tracking ransomware deployment and impact. They used the Kusto Query Language (KQL) to analyze intrusion data and build an understanding of the ransomware attack lifecycle.
Issued on: Dec 02, 2024
Critical Compromise (ICS)
This analyst completed the Critical Compromise in Chicago module, demonstrating their ability to investigate a malware-based attack on a SCADA system. Through their use of Kusto Query Language (KQL), they uncovered the deployment of malicious software that disrupted the power grid. Their investigation helped identify the attack's origin and provided insights into the attackers’ methods, ultimately contributing to the restoration of normal operations and improving defenses for critical infrastructure.
Issued on: Dec 02, 2024
A Storm in Brewing in the Lab
This analyst investigated a complex scenario in the "Storm in Brewing in the Lab" module using Synapse, a platform from The Vertex Project. They utilized threat intelligence and Storm Query Language to guide their investigation, demonstrating skills in leveraging advanced tools and integrating threat data to uncover and understand security threats.
Issued on: Dec 05, 2024
Balloons Over Iowa
This analyst completed the "Balloons Over Iowa" module, investigating a phishing and ransomware attack. They identified command and control connections, detected data exfiltration, analyzed Mimikatz activity, and observed shadow copy deletions, demonstrating their ability to effectively respond to and analyze cyber threats.
Issued on: Dec 05, 2024
Dai Wok Foods
This analyst completed the "Dai Wok Foods" module. They demonstrated skills in detecting phishing attempts, analyzing email logs, and using Passive DNS for domain analysis. This proficiency is vital for countering threat actor tactics and protecting organizational assets.
Issued on: Dec 05, 2024
Celestial Cowboy Couture
This analyst completed the "Celestial Cowboy Couture" module, where they investigated a targeted phishing attack that resulted in data exfiltration and intellectual property theft. They demonstrated proficiency in using Kusto Query Language (KQL) to trace the attack, analyzing network traffic and credential misuse. The investigation involved connecting threat actor tactics, including the exploitation of an employee’s LinkedIn post to craft a convincing phishing email. By uncovering the full attack chain, the analyst successfully identified the real culprit and restored the company’s reputation.
Issued on: Jan 14, 2025
Super Fan
This badge is issued to any KC7 player who has completed 3 modules or more!
Issued on: Mar 15, 2025
GalaxyNeura
This badge is awarded to threat hunters who successfully utilize the GalaxyNeura Module to identify, analyze, and mitigate insider threats, showcasing expertise in detecting malicious activity within trusted environments.
Issued on: Mar 17, 2025
Clout Defender
This analyst unraveled a targeted phishing and social engineering attack against a rising influencer. Through OSINT, phishing analysis, and log forensics, they uncovered how personal details shared on social media were exploited to compromise her accounts. Using Kusto Query Language (KQL), they analyzed employee logs, inbound and outbound traffic, and passive DNS data to trace the attacker’s steps and infrastructure. This exercise strengthened skills in threat analysis, digital forensics, and understanding the real-world risks of oversharing online.
Issued on: Nov 11, 2025
Long live FokkeBV
You've successfully uncovered how an access broker got in, kept their toes inside the network, and then shared access to a ransomware group.
Issued on: Nov 11, 2025
Advanced Persistent Analyst
Someone who failed, got up, and tried again!
Issued on: Dec 06, 2025
MCJ Walker
This analyst completed the "MCJ Walker" module, demonstrating mastery of advanced investigative skills. They used Kusto Query Language (KQL) in an investigation that covered a sophisticated password spray attack, lateral movement via RDP, and full domain compromise. This exercise showcased their expert-level ability to respond to advanced cyber threats by leveraging in-depth knowledge of threat actor tactics, techniques, and procedures (TTPs).
Issued on: Dec 06, 2025
3 day streak
Awarded to a user who has answered a question for 3 days in a row!
Issued on: Feb 02, 2026
ultimatro played 38 games
Level 1: A Scandal in Valdoria: A Political Mystery 2430/2430
Level 1: Solvi Systems: A tale of Supply Chains and ICS 2860/2860
Level 1: A Rap Beef: An Intro to Security Investigations 950/950
Level 1: Jojo's Hospital: A Ransomware Investigation 610/610
Level 1: VirusTotal Fundamentals 2620/2620
Level 1: Titan Shield: A showcase of Microsoft Defender XDR 4000/4000
Level 1: Cowboy Couture: A Steampunk Space Adventure 2040/2040
Level 1: Valdoria Votes: A Political Mystery (Part 2) 2750/2750
Level 1: KQL 101: An introduction to Kusto Query Languge 1645/1645
Level 1: CloutHaus: Social Media leads to Compromise 1170/1170
Level 1: How to play KC7 190/190
Level 2: Envolve Labs: With a twist! 950/950
Level 2: HopsNStuff: An Easter APT hunt 14265/14265
Level 2: Krusty Krab: A Intro to Pivoting and Analysis 7360/7360
Level 2: Castle & Sand: A Beachy Case of Ransomware 13050/13050
Level 2: AzureCrest - The full version 8790/8790
Level 2: Frognado in Valdoria: A Political Mystery 1690/1690
Level 2: Critical Compromise In Chicago - ICS 2870/2870
Level 2: French Socksess Story 2080/2080
Level 2: Turkey Bowl 2590/2590
Level 2: KQL 201: An Intermediary Course on KQL 1070/1070
Level 3: Balloons Over Iowa 4405/4405
Level 3: Dai Wok Foods: A Challenging Culinary Mystery 11600/11600
Level 3: DAILY7 🌎 7283/7346
Level 3: Scholomance: Secrets and Lateral Movement 5640/5640
Level 3: A Storm Is Brewing In the Lab 5670/5670
Level 3: Inside Encryptodera: An Insider Threat Scenario 3990/3990
Level 3: System Shutdown at Azure Crest! (Short Version) 4800/4800
Level 3: Galaxy Neura 1265/1265
Level 3: Empire Health 1195/1195
Level 3: Whiskermania: An Intro to Network Concepts 2275/2275
Level 4: World Domination Nation 8220/8220
Level 4: Sunlands: A Tough Space Investigation 8437/8437
Level 4: Spooky Sweets: Sweet Sweet Pivots 7640/7640
Level 4: Ship ahoy! An Unusual Ransomware Investgation 2320/2320
Level 5: MCJ Walker: An Impossible Identity Crisis 15265/15265
Level 5: A Rap Steak: A Tough Musical Affair 19010/19010
Pattern of Life
Issue Badge to ultimatro
| # | Image | Badge | Description | Action |
|---|---|---|---|---|
| 1 |  | 2024 SANS New2Cyber CTF Participant | This badge has been awarded to those who took part in the 2024 SANS New2Cyber x KC7 Capture The Flag (CTF) challenge, which involved investigating a ransomware attack on a hospital. | |
| 2 | | Intro Master | Intro Master | |
| 3 |  | Azure Crest | This analyst investigated a ransomware attack, where cost-cutting measures led to a single point of failure in their systems. This exercise highlighted the risks associated with prioritizing cost over security and reinforced skills in identifying vulnerabilities and understanding the broader implications of inadequate security measures in a healthcare context. | |
| 4 |  | Wiccon25 | You've participated to the WICCON25 workshop! You've successfully uncovered the full attack chain of a zombie themed ransomware. | |
| 5 |  | Helping Hand | This award is community-nominated! Someone in the KC7 community has recognized this user for their contributions to others! | |
| 6 |  | Most Improved | Someone who really improved over the course of a KC7 event! | |
| 7 |  | Notre Dame Challenge | Completed the cybersecurity challenge event at Notre Dame in June 2023 | |
| 8 |  | KC7 Top 10 (2023) | Awarded to top 10 KC7 players in 2023 | |
| 9 |  | Cyber Challenge Series: Team Winner | This badge is issued to KC7 players who were members of a team that placed top 3 in a Blue Team Cyber Challenge event! | |
| 10 |  | 30 day hot steak | Awarded to a user who has answered a question for 30 days in a row. | |
| 11 |  | 90 day streak | Awarded to a user who has answered a question for 90 days in a row. | |
| 12 |  | The Teacher | Someone who really helped lift up their peers and enabled others to learn! | |
| 13 |  | Inside Encryptodera - Event Participant | Participant in the February 2024 monthly event featuring the Encryptodera module | |
| 14 |  | Cyber Challenge Series: Winner | This badge is issued to KC7 players who placed top 3 (as an individual) in an Blue Team Cyber Challenge event! | |
| 15 |  | 45 day streak | Awarded to a user who has answered a question for 45 days in a row! | |
| 16 |  | 360 day streak | Awarded to a user who has answered a question for 360 days in a row! | |
| 17 |  | 60 day streak | Awarded to a user who has answered a question for 60 days in a row. | |
| 18 |  | 120 day streak | Awarded to a user who has answered a question for 120 days in a row! | |
| 19 |  | Bright Future | Someone who shows a lot of potential as a future cyber analyst! | |
| 20 |  | 10 day streak | Awarded to a user who has answered a question for 10 days in a row! | |
| 21 |  | 180 day streak | Awarded to a user who has answered a question for 180 days in a row! |