PHANTOM - Case File 1 (CTF)
Awarded to Anthony Bendas on May 20, 2026
PHANTOM (CTF) was awarded for completing Case File 1 during the live 72-hour Blue Team CTF on Guardian Foundry, May 22 to 24, 2026. Earners triaged a simulated CI/CD pipeline incident from raw artifacts under a competition clock, identified indicators of compromise, built detection rules across host and network telemetry, executed an enterprise-scale threat hunt, and produced a complete incident response report. Scores were ranked on a live leaderboard.
Criteria
To earn PHANTOM (CTF), competitors completed Case File 1 within the 72-hour event window and submitted passing work across all required deliverables:
- Extracted and answered 10 indicator-of-compromise questions from a multi-artifact incident package
- Completed 2 write-ups covering threat actor attribution and operational impact
- Authored 3 detection rules: YARA (malicious payload), Snort (exfiltration traffic), and Sigma (build-time process telemetry)
- Built an enterprise threat hunt query in either KQL or PowerShell
- Produced a complete incident report including IOC entries table, executive summary, technical analysis mapped to MITRE ATT&CK, and remediation steps
Work was scored for points and ranked against all other competitors on a live leaderboard. Case File 1 is now available as a self-paced course; this badge marks participation in the original timed competition.