BLACKMASS
STUDIOSStart a project ↗

THE CYBER STU SUITE / ANALYSIS TOOLS

Small tools.
Clear answers.

Learn threat patterns, build detection hunts, draft assessment checklists, then defang IOCs, decode text, fingerprint files, and generate defensive PowerShell — all in the browser.

← Open the full suite and terminology guide

YOUR INPUT STAYS HEREThese tools process text and files in your browser.
01

Defender prep

Learn common threat patterns in plain English, build detection hunts for your SIEM, and draft authorised assessment checklists. Learn → Detect → Document.

Defender prep — authorised security work only

Learn what common threat patterns look like, build detection filters for your SIEM, and draft assessment checklists. This workspace does not generate attack or exploit commands.

Reconnaissance

Network reconnaissance (scanning)

Attackers map what is listening on a network. Defenders watch for unusual scan patterns so they can investigate before exploitation starts.

If you are new — start here

  1. Reconnaissance is the “looking around” stage — finding hosts, ports, and services.
  2. It is not itself a break-in, but it often comes right before one.
  3. Your job: know which scans are expected (approved assessment, vulnerability scanner) and which are not.
  4. Start by answering: who scanned, from where, what targets, and was it in change/approval records?

What it looks like

  • Many connection attempts from one source to many ports or many hosts in a short window
  • Firewall / IDS alerts for port sweeps or unusual protocol probes
  • VPN or jump-box traffic probing internal ranges outside normal admin behaviour

Defender response

  • Confirm whether the source is an approved scanner or engagement
  • Preserve firewall / IDS / NetFlow evidence with timestamps
  • If unapproved: contain the source host or account, then investigate for follow-on activity