ContinuumCon 2026 CTF - DFIR Report: ENVELOPE
Awarded to Ayinde Perouza on June 19, 2026
Finished 4th of 22 participants
Description
ENVELOPE is awarded to competitors in the ContinuumCon 2026 CTF on Guardian Foundry, a hands-on incident response and reverse engineering scenario built around a phishing-driven endpoint compromise.
Working from a pre-compromised Windows workstation and a live environment, the challenge tasked players with tracing initial access from a malicious phishing ZIP through LNK and PowerShell execution, hunting the persistence mechanisms used to survive reboot, reverse engineering the implant and its custom C2 protocol, and tracking indicators of compromise across the host.
Earners competed during the live event and finished with a scored placement on the final leaderboard.
Criteria
To earn ENVELOPE, competitors took part in the ContinuumCon 2026 CTF during the live event window of June 12 to 14, 2026, and earned a scored ranking:
- Investigated a pre-compromised Windows workstation built around a phishing-driven endpoint compromise
- Captured flags across the available challenge categories (initial access, persistence, reverse engineering, live C2)
- Submitted detection rules in YARA, Snort, and Sigma format against IOCs discovered
- Submitted analytical write-ups (threat intelligence, GRC, incident reporting)
- Finished with a final placement on the CTF leaderboard
Students with 3000 points and above also:
- Submitted a full DFIR report
- Report included Executive Summary, Technical Analysis, and Remediations
- Report was manually reviewed by an Instructor to award the points and must have been passing in all criteria detailing the incident correctly
A competitor's specific rank is recorded on their individual verification.