Skip to content
@HellCatLabs

HellCat Labs

Labs and tools for SOC analysts, detection engineers, and blue teamers. Learn by building. Stay sharp. 🛡️

🐾 HellCatLabs

🎓 Hands-on cybersecurity labs for beginners, by @Sn0wAlice
👩‍💻 Learn SOC, scripting, detection engineering, and security automation — the fun way.


🚀 What is this?

HellCatLabs is a collection of simple, guided labs designed to help you:

  • Understand how a SOC works
  • Practice detection & triage
  • Automate security analysis with code
  • Build your own tools as a SOC engineer

Each lab is self-contained, beginner-friendly, and built to be completed in under an hour.


📚 Available Labs

Lab Description Difficulty
ioc-extractor-lite Build a Python script to extract IOCs from log files 🟢 Easy
sigmad Use Sigma rules to detect threats in log data 🟢 Easy
(build in progress...) (enrich alerts, parse logs, generate fake incidents...) 🟡 Medium ?

🧠 Philosophy

We believe the best way to learn cybersecurity is by doing.
No theory dumps. Just small, focused exercises with real-world flavor.


🤝 Contribute

Want to share your own lab or help improve an existing one?
Check our contribution guide (soon) or open an issue/discussion.


🐈‍⬛ About

Created by @Sn0wAlice
Maintained by the HellCatLabs team.
Feel free to fork, learn, and spread the labs!

Pinned Loading

  1. ioc-extractor-lite ioc-extractor-lite Public

    🛠️ Lightweight CLI tool to extract IOCs (Indicators of Compromise) from raw log files. Supports IP addresses, domains, URLs, and common hash formats. Ideal for beginner SOC analysts and automation …

    Python 1

  2. sigmad sigmad Public

    🧠 Lightweight Sigma rule engine in Python — scan log files locally, match Sigma rules, and detect suspicious activity without a SIEM.

    Python 2

Repositories

Showing 6 of 6 repositories
  • hellcat-cybersec-fundamental Public

    This repository is designed for educational purposes, with real code, real labs, and real-world logic — but zero bullshit.

    HellCatLabs/hellcat-cybersec-fundamental's past year of commit activity
    Python 9 GPL-3.0 0 0 0 Updated Mar 3, 2026
  • DarkReach Public

    A Rust-based adversary simulation framework composed of a command-line interface, a C2 server, and a cross-platform agent. Designed for internal security testing, automation, and red team operations.

    HellCatLabs/DarkReach's past year of commit activity
    Rust 2 GPL-3.0 0 0 0 Updated Dec 13, 2025
  • honeypot-lab Public

    🧲 A beginner-friendly lab to build your own Python honeypot from scratch (SSH & HTTP). Learn how to simulate fake services, capture incoming traffic, and log attacker behavior — step by step, with explanations and full solution included.

    HellCatLabs/honeypot-lab's past year of commit activity
    Python 2 GPL-3.0 0 0 0 Updated Oct 18, 2025
  • .github Public
    HellCatLabs/.github's past year of commit activity
    0 0 0 0 Updated Oct 14, 2025
  • sigmad Public

    🧠 Lightweight Sigma rule engine in Python — scan log files locally, match Sigma rules, and detect suspicious activity without a SIEM.

    HellCatLabs/sigmad's past year of commit activity
    Python 2 GPL-3.0 0 0 0 Updated Oct 14, 2025
  • ioc-extractor-lite Public

    🛠️ Lightweight CLI tool to extract IOCs (Indicators of Compromise) from raw log files. Supports IP addresses, domains, URLs, and common hash formats. Ideal for beginner SOC analysts and automation scripting.

    HellCatLabs/ioc-extractor-lite's past year of commit activity
    Python 1 GPL-3.0 0 0 0 Updated Oct 14, 2025

Top languages

Loading…

Most used topics

Loading…