 |
MITRE |
Explore the various resources that MITRE has made available to the cyber security community. |
Medium
|
Walkthrough
|
 |
Phishing Analysis Fundamentals |
Learn all the components that make up an email. |
Easy
|
Walkthrough
|
 |
Phishing Analysis Tools |
Learn the tools used to aid an analyst to investigate suspicious emails. |
Easy
|
Walkthrough
|
 |
Phishing Emails in Action |
Learn the different indicators of phishing attempts by examining actual phishing emails. |
Easy
|
Walkthrough
|
 |
Junior Security Analyst Intro |
Play through a day in the life of a Security Analyst and experience their everyday duties. |
Easy
|
Walkthrough
|
 |
Phishing Prevention |
Learn how to defend against phishing emails. |
Easy
|
Walkthrough
|
 |
Pyramid Of Pain |
Learn what is the Pyramid of Pain and how to utilize this model to determine the level of difficulty it will cause for an adversary to change the indicators associated with them, and their campaign. |
Easy
|
Walkthrough
|
 |
The Greenholt Phish |
Use the knowledge attained to analyze a malicious email. |
Easy
|
Challenge
|
 |
Cyber Kill Chain |
The Cyber Kill Chain framework is designed for identification and prevention of the network intrusions. You will learn what the adversaries need to do in order to achieve their goals. |
Easy
|
Walkthrough
|
 |
Snort |
Learn how to use Snort to detect real-time threats, analyse recorded traffic files and identify anomalies. |
Medium
|
Walkthrough
|
 |
Intro to Malware Analysis |
What to do when you run into a suspected malware. |
Medium
|
Walkthrough
|
 |
NetworkMiner |
Learn how to use NetworkMiner to analyse recorded traffic files and practice network forensics activities. |
Easy
|
Walkthrough
|
 |
Elastic Stack: The Basics |
Understand how SOC analysts use the Elastic Stack (ELK) for log investigations. |
Medium
|
Walkthrough
|
 |
Unified Kill Chain |
The Unified Kill Chain is a framework which establishes the phases of an attack, and a means of identifying and mitigating risk to IT assets. |
Easy
|
Walkthrough
|
 |
ItsyBitsy |
Put your ELK knowledge together and investigate an incident. |
Medium
|
Challenge
|
 |
Benign |
Challenge room to investigate a compromised host. |
Medium
|
Challenge
|
 |
Wireshark: The Basics |
Learn the basics of Wireshark and how to analyse protocols and PCAPs. |
Easy
|
Walkthrough
|
 |
Intro to Cyber Threat Intel |
Introducing cyber threat intelligence and related topics, such as relevant standards and frameworks. |
Easy
|
Walkthrough
|
 |
Wireshark: Packet Operations |
Learn the fundamentals of packet analysis with Wireshark and how to find the needle in the haystack! |
Easy
|
Walkthrough
|
 |
Introduction to SIEM |
Learn the fundamentals of SIEM and explore its features and functionality. |
Easy
|
Walkthrough
|
 |
Tempest |
You are tasked to conduct an investigation from a workstation affected by a full attack chain. |
Medium
|
Challenge
|
 |
Wireshark: Traffic Analysis |
Learn the basics of traffic analysis with Wireshark and how to find anomalies on your network! |
Medium
|
Walkthrough
|
 |
Introduction to SOAR |
Learn the concepts and methodology surrounding security orchestration, automation, and response. |
Medium
|
Walkthrough
|
 |
Splunk: The Basics |
Understand how SOC analysts use Splunk for log investigations. |
Easy
|
Walkthrough
|
 |
Boogeyman 1 |
A new threat actor emerges from the wild using the name Boogeyman. Are you afraid of the Boogeyman? |
Medium
|
Walkthrough
|
 |
Snapped Phish-ing Line |
Apply learned skills to probe malicious emails and URLs, exposing a vast phishing campaign. |
Easy
|
Challenge
|
 |
Intro to Logs |
Learn the fundamentals of logging, data sources, collection methods and principles to step into the log analysis world. |
Easy
|
Walkthrough
|
 |
Boogeyman 2 |
The Boogeyman is back. Are you still afraid of the Boogeyman? |
Medium
|
Challenge
|
 |
Boogeyman 3 |
The Boogeyman emerges from the darkness again. |
Medium
|
Challenge
|
 |
Intro to Log Analysis |
An intro to log analysis, best practices, and essential tools for effective detection and response. |
Easy
|
Walkthrough
|
 |
Eviction |
Unearth the monster from under your bed. |
Easy
|
Walkthrough
|
 |
Summit |
Can you chase a simulated adversary up the Pyramid of Pain until they finally back down? |
Easy
|
Challenge
|
 |
Log Operations |
Learn the operation process details. |
Easy
|
Walkthrough
|
 |
IDS Fundamentals |
Learn the fundamentals of IDS, along with the experience of working with Snort. |
Easy
|
Walkthrough
|
 |
SOC L1 Alert Triage |
Learn more about SOC alerts and build a systematic approach to efficiently triaging them. |
Easy
|
Walkthrough
|
 |
SOC L1 Alert Reporting |
Learn how to properly report, escalate, and communicate about high-risk SOC alerts. |
Easy
|
Walkthrough
|
 |
SOC Workbooks and Lookups |
Discover useful corporate resources to help you structure and simplify L1 alert triage. |
Easy
|
Walkthrough
|
 |
SOC Metrics and Objectives |
Explore key metrics driving SOC effectiveness and discover ways to improve them. |
Easy
|
Walkthrough
|
 |
Windows Logging for SOC |
Start your Windows monitoring journey by learning how to use system logs to detect threats. |
Easy
|
Walkthrough
|
 |
Windows Threat Detection 1 |
Explore common Initial Access methods on Windows and learn how to detect them. |
Medium
|
Walkthrough
|
 |
Windows Threat Detection 2 |
Discover how to detect and analyze the first steps of threat actors after breaching Windows. |
Medium
|
Walkthrough
|
 |
Detecting Web Shells |
Explore web shell detection by analyzing logs, file systems, and network traffic. |
Easy
|
Walkthrough
|
 |
File and Hash Threat Intel |
This room seeks to teach on enriching file and hash artefacts using threat intelligence. |
Easy
|
Walkthrough
|
 |
Windows Threat Detection 3 |
Learn how threat actors manage to maintain access to the breached Windows hosts. |
Medium
|
Walkthrough
|
 |
Humans as Attack Vectors |
Understand why and how people are targeted in cyber attacks and how the SOC helps defend them. |
Easy
|
Walkthrough
|
 |
Systems as Attack Vectors |
Learn how attackers exploit vulnerable and misconfigured systems, and how you can protect them. |
Easy
|
Walkthrough
|
 |
Log Analysis with SIEM |
Learn how SIEM solutions can be used to detect and analyse malicious behaviour. |
Medium
|
Walkthrough
|
 |
SOC Role in Blue Team |
Discover security roles and learn how to advance your SOC career, starting from the L1 analyst. |
Easy
|
Walkthrough
|
 |
Web Security Essentials |
Learn how the web works, common website security risks, and protections for a safer internet. |
Easy
|
Walkthrough
|
 |
Network Discovery Detection |
Understand how attackers discover assets in a network, and how to detect that activity. |
Medium
|
Walkthrough
|
 |
Linux Logging for SOC |
Explore key Linux log sources and learn how to use them in your SOC triage. |
Easy
|
Walkthrough
|
 |
IP and Domain Threat Intel |
A look into enriching IP and domain insights with open source threat intelligence. |
Medium
|
Walkthrough
|
 |
Invite Only |
Extract insight from a set of flagged artefacts, and distil the information into usable threat intelligence. |
Easy
|
Challenge
|
 |
Detecting Web Attacks |
Explore web attacks and detection methods through log and network traffic analysis. |
Easy
|
Walkthrough
|
 |
Man-in-the-Middle Detection |
Learn what MITM attack is, and how to identify the footprints of this attack in the network traffic. |
Easy
|
Walkthrough
|
 |
Linux Threat Detection 1 |
Explore how attackers break into Linux systems and how you can detect this in logs. |
Medium
|
Walkthrough
|
 |
Malware Classification |
Learn how to identify, classify, and understand common types of malware. |
Easy
|
Walkthrough
|
 |
Alert Triage With Splunk |
Use Splunk to triage alerts and investigate malicious activity efficiently. |
Medium
|
Walkthrough
|
 |
Introduction to EDR |
Learn the fundamentals of EDR and explore its features and working. |
Easy
|
Walkthrough
|
 |
Network Security Essentials |
Learn about key aspects of network security essentials and how to monitor and protect against adversaries. |
Easy
|
Walkthrough
|
 |
Detecting Web DDoS |
Explore denial-of-service attacks, detection techniques, and strategies for protection. |
Easy
|
Walkthrough
|
 |
Linux Threat Detection 2 |
Explore the first actions of attackers after breaching a Linux server and learn how to detect them. |
Medium
|
Walkthrough
|
 |
Shadow Trace |
Analyse a suspicious file, uncover hidden clues, and trace the source of the infection. |
Easy
|
Challenge
|
 |
Linux Threat Detection 3 |
Cover the last stages of attacks on Linux and learn how they look in system logs. |
Medium
|
Walkthrough
|
 |
Alert Triage With Elastic |
Investigate alerts with Elastic by analyzing logs and spotting threats. |
Medium
|
Walkthrough
|
 |
Network Traffic Basics |
Learn what network analysis is, why it is essential, how to collect network traffic and which tools are available |
Easy
|
Walkthrough
|
 |
Data Exfiltration Detection |
Learn how to detect data exfiltration attempts in various network channels. |
Medium
|
Walkthrough
|
 |
Living Off the Land Attacks |
Learn to detect and analyse Living Off the Land attacks using trusted Windows tools. |
Easy
|
Walkthrough
|