Learning Objectives

• Build a structured investigator’s mindset for approaching security incidents methodically
• Apply industry-standard tools and methodologies for detecting, hunting, and responding to threats across enterprise environments
• Practice performing incident response and threat hunting at scale
• Identify and investigate advanced adversary tactics using the MITRE ATT&CK framework, including execution artifacts, lateral movement, credential theft, living-off-the-land techniques, persistence, defense evasion, and command and control
• Conduct attack timeline analysis to support incident response and remediation efforts
• Determine the root cause and initial entry point of security incidents

Course Outline

Module Day 1: Adversary Understanding, Incident Response, and Threat Hunting Foundations

Introduces the modern adversary landscape, incident response concepts, and incident decision-making. Covers the fundamentals of threat hunting including team structures, data sources, and maturity models. Addresses cyber threat intelligence, use of the MITRE ATT&CK Navigator, structured and unstructured hunting approaches, and data transformation using the command line, PowerShell, and Splunk, including searching, aggregations, statistics, and visualizations.

Module Day 2: Anomaly Analysis and Advanced Threat Hunting

Examines how to identify and categorize anomalies, including masquerading, ambiguous identifiers, frequency and volume anomalies, temporal anomalies, location and environmental anomalies, structure and format anomalies, absence and suppression anomalies, and entropy analysis. Includes analysis of threat reports, threat hunting labs, attack chain tracing, and hands-on hunting covering execution, malicious process trees, persistence, defense evasion, command and control, and lateral movement.

Module Day 3: Large-Scale Collection, Incident Response Tools, and Memory Analysis

Covers large-scale data collection using WMI, PowerShell fundamentals, PowerShell remoting, remote collection frameworks, and triage artifact collection with KAPE. Introduces incident response workflows using Velociraptor and covers Windows memory structures, the Volatility framework, and analysis techniques for processes, command lines, network traffic, and the registry.