# anh-cybersecurity/cyberdefenders_writeup architecture

> Architecture diagram of the GitHub repository anh-cybersecurity/cyberdefenders_writeup, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/anh-cybersecurity/cyberdefenders_writeup
- Repository: https://github.com/anh-cybersecurity/cyberdefenders_writeup

## Overview

This repository is a collection of Blue Team lab walkthroughs and forensic reference notes for learning investigation skills. Its user workflow is to consult a challenge writeup or a topic note while studying an analysis technique; the files are standalone documents, not an executable application. The README describes the collection and names commonly used tools, but the available evidence does not establish links between particular documents, tools, or investigation stages, so no relationships are asserted.

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_walkthroughs["Lab writeups"]
  node_benign["Benign lab<br/>[Benign.md]"]
  node_phishstrike["PhishStrike lab<br/>[PhishStrike Lab.md]"]
  node_sysinternals["Sysinternals lab"]
  node_unit42["Unit42 lab<br/>[Unit42.md]"]
end

subgraph group_reference["Forensic notes"]
  node_amcache["Amcache hive notes<br/>[Amcache Hve.md]"]
  node_powershell["PowerShell history notes"]
  node_phishstrike_notes["PhishStrike notes<br/>[PhishStrike Lab.md]"]
end

node_readme["Collection overview<br/>[README.md]"]

click node_readme "https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/README.md"
click node_benign "https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/Benign.md"
click node_phishstrike "https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/PhishStrike%20Lab.md"
click node_sysinternals "https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/Sysinternals%20Lab.md"
click node_unit42 "https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/Unit42.md"
click node_amcache "https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/Notes/Amcache%20Hve.md"
click node_powershell "https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/Notes/Powershell%20History.md"
click node_phishstrike_notes "https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/PhishStrike%20Lab.md"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_benign,node_phishstrike,node_sysinternals,node_unit42,node_readme toneBlue
class node_amcache,node_powershell,node_phishstrike_notes toneAmber
```

## Components

### Lab writeups

- [Benign lab](https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/Benign.md): `Benign.md`
- [PhishStrike lab](https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/PhishStrike%20Lab.md): `PhishStrike Lab.md`
- [Sysinternals lab](https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/Sysinternals%20Lab.md): `Sysinternals Lab.md`
- [Unit42 lab](https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/Unit42.md): `Unit42.md`

### Forensic notes

- [Amcache hive notes](https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/Notes/Amcache%20Hve.md): `Notes/Amcache Hve.md`
- [PowerShell history notes](https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/Notes/Powershell%20History.md): `Notes/Powershell History.md`
- [PhishStrike notes](https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/PhishStrike%20Lab.md): `PhishStrike Lab.md`

### Other components

- [Collection overview](https://github.com/anh-cybersecurity/cyberdefenders_writeup/blob/main/README.md): `README.md`