Skip to content
Enterprise Security Operations
Introduction
Course Introduction Sample Lesson
Welcome and Course Overview
Course Logistics, Resources and Support
Offline Lab Setup
Optional: Offline Lab Setup Instructions
Cyber Threat Landscape Sample Lesson
Mastering Enterprise Security: Threat Actors, Attacks, and Response
1) Enterprise Domain Environments
1.1 Enterprise Domain Environments
Domains and Active Directory Overview
Accounts and Credential Abuse Techniques
1.1 Lab Instructions
Lab: Domain Controllers and User Accounts Management
Lab: Managing Group Policy Objects
Lab: Deploy Ransomware using GPOs
1.2 Logging, Telemetry, Visibility Sample Lesson
Logging, Telemetry and Visibility Overview
1.2.1 Windows Event Logs
1.2.1 Lab Instructions
Lab: Exploring and Analyzing Windows Event Logs
Lab: Enabling Process Creation Events and Analysis with PowerShell
1.2.2 PowerShell Event Logging and Tuning
PowerShell Logging Matters
1.2.2 Lab Instructions
Lab: PowerShell Logging Basics
Greater Visibility Through PowerShell Advanced Logging
Lab: PowerShell Logging Advanced
1.2.3 Sysmon Event Logging and Detection
Sysmon Essentials – Introduction into Powerful System Monitoring
1.2.3 Lab Instructions
Lab: Setting Up Sysmon – Installation and Essential Configurations
Harnessing Sysmon Configurations: Optimize Monitoring Efficiency
Lab: Customizing Sysmon Templates
Lab: Next-Level Sysmon – Enhanced Detections and Advanced Configurations
2) Initial Access
Initial Access Techniques
Understanding Initial Access Techniques: Real-World Insights and Statistics
2.1 Lab Instructions
Lab: Exploring Malicious Office Documents with Macros
SQL Injections Primer
Lab: Analyzing FortiClient EMS Logs for SQL Injection Attacks (CVE-2023-48788)
3) LOLBins
Discovery, Execution and File Transfer with LOLBins
LOLBins Overview
3.1 Lab Instructions
Lab: System Reconnaissance with LOLBins
Lab: Malicious PowerShell Execution Techniques
Lab: Execution and Persistence with Service Installs
Common Miscellaneous LOLBin Usage
4) Discovery
Domain Reconnaissance
Domain Enumeration Introduction
4.1 Lab Instructions
Lab: Active Directory Enumeration with PowerView
Lab: Suspicious ADFind Domain Enumeration
Advanced Domain Enumeration with BloodHound
5) Credential Attacks
Credential Dumping
The Windows Authentication Architecture
5.1 Lab Instructions
Lab: Dumping NTLM hashes with Mimikatz
Lab: Extracting NTLM Hashes Offline
Lab: Cracking NTLM Hashes
Sessions and Tokens
Windows Logon Sessions and Access Tokens
Lab: Token Impersonation Attack
6) Lateral Movement
Lateral Movement Techniques
Windows SSO and Lateral Movement Techniques Overview
Demo: Pass-the-hash, Pass-the-ticket and PsExec
7) Windows Endpoint Compromise
Windows Endpoint Compromise Overview
Windows Endpoint Compromise Tactics and Techniques
7 Lab Instructions
Persistence Mechanisms
Lab: Autostart via Registry Runkeys and Startup Folders
Lab: Scheduled Tasks for Initial or Recurring Execution of Malicious Code
Lab: Persistence via WMI Event Subscribers
Privilege Escalation Techniques
Common Privilege Escalation Tactics
Lab: Bypassing the User Account Control
Execution and Defense Evasion
Introduction Into Process Internals
Demo: Exploring Live Windows Processes and What Looks Normal
Lab: Deep Dive into Process Injection with Process Hollowing
Bypassing AVs and EDRs in Modern Day Environments
Data Staging and Exfiltration Techniques
Lab: Manual Data Staging and Exfiltration Using RClone
Lab: Automated Data Exfiltration with Exbyte
8) Network Telemetry
Network Telemetry and Security
Network Telemetry and Security Introduction
8 Lab Instructions
Windows Network Security
Lab: Network Security on Windows Endpoints
Lab: Common Techniques for Tampering with Windows Firewalls
C2 Beacon Analysis
C2 Attack Infrastructure and Beacons Overview
Lab: Extracting Network Indicators from C2 Beacon Payloads
Lab: Hunting for Beacons via PCAP Analysis and Fingerprinting
9) Malware
Static Malware Analysis
Understanding Binary File Formats
9 Lab Instructions
Lab: Analyzing File Types and Formats
Lab: Advanced File Examination and Header Inspection
Lab: Analyzing Files for Malicious Behavior with CAPA
Lab: Extracting Malicious Macros in Office Documents
Lab: Static Portable Executable File Analysis with PEStudio
Dynamic Malware Analysis
Lab: Decompiling and Debugging .NET Malware with dnSpy
PowerShell Payload Analysis
Lab: Analyzing Payloads and Extracting Shellcode Part 1
Lab: Analyzing Payloads and Extracting Shellcode Part 2
Gathering Intel via VirusTotal
Final
Congratulations and Next Steps
Previous Lesson
Next Topic

Welcome and Course Overview

  1. Enterprise Security Operations
  2. Course Introduction
  3. Welcome and Course Overview
Previous Lesson
Back to Lesson
Next Topic
Manage Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
  • Manage options
  • Manage services
  • Manage {vendor_count} vendors
  • Read more about these purposes
Preferences
  • {title}
  • {title}
  • {title}
Scroll to Top

Training Waitlist

Join our waitlist and get notified when training becomes available.

Contact Information
Professional Experience
I'm interested in

*By submitting this form, you’re agreeing that we will contact you and to receive our free email newsletter. (You’ll never be spammed and you can unsubscribe at any time.) We do not share your information with third-parties.