 |
MITRE |
Explore the various resources that MITRE has made available to the cyber security community. |
Medium
|
Walkthrough
|
 |
Phishing Analysis Fundamentals |
Learn all the components that make up an email. |
Easy
|
Walkthrough
|
 |
Phishing Analysis Tools |
Learn the tools used to aid an analyst to investigate suspicious emails. |
Easy
|
Walkthrough
|
 |
Phishing Emails in Action |
Learn the different indicators of phishing attempts by examining actual phishing emails. |
Easy
|
Walkthrough
|
 |
Junior Security Analyst Intro |
Play through a day in the life of a Security Analyst and experience their everyday duties. |
Easy
|
Walkthrough
|
 |
Phishing Prevention |
Learn how to defend against phishing emails. |
Easy
|
Walkthrough
|
 |
Pyramid Of Pain |
Learn what is the Pyramid of Pain and how to utilize this model to determine the level of difficulty it will cause for an adversary to change the indicators associated with them, and their campaign. |
Easy
|
Walkthrough
|
 |
The Greenholt Phish |
Use the knowledge attained to analyze a malicious email. |
Easy
|
Challenge
|
 |
Cyber Kill Chain |
The Cyber Kill Chain framework is designed for identification and prevention of the network intrusions. You will learn what the adversaries need to do in order to achieve their goals. |
Easy
|
Walkthrough
|
 |
Snort |
Learn how to use Snort to detect real-time threats, analyse recorded traffic files and identify anomalies. |
Medium
|
Walkthrough
|
 |
Intro to Malware Analysis |
What to do when you run into a suspected malware. |
Medium
|
Walkthrough
|
 |
NetworkMiner |
Learn how to use NetworkMiner to analyse recorded traffic files and practice network forensics activities. |
Easy
|
Walkthrough
|
 |
Introduction to DevSecOps |
Learn about the story of DevSecOps, Software Development Models & Shifting Left. |
Medium
|
Walkthrough
|
 |
Elastic Stack: The Basics |
Understand how SOC analysts use the Elastic Stack (ELK) for log investigations. |
Medium
|
Walkthrough
|
 |
Unified Kill Chain |
The Unified Kill Chain is a framework which establishes the phases of an attack, and a means of identifying and mitigating risk to IT assets. |
Easy
|
Walkthrough
|
 |
ItsyBitsy |
Put your ELK knowledge together and investigate an incident. |
Medium
|
Challenge
|
 |
Benign |
Challenge room to investigate a compromised host. |
Medium
|
Challenge
|
 |
SSDLC |
This room focuses on the Secure Software Development Lifecycle (S-SDLC), its processes, and methodologies. |
Medium
|
Walkthrough
|
 |
Wireshark: The Basics |
Learn the basics of Wireshark and how to analyse protocols and PCAPs. |
Easy
|
Walkthrough
|
 |
Intro to Cyber Threat Intel |
Introducing cyber threat intelligence and related topics, such as relevant standards and frameworks. |
Easy
|
Walkthrough
|
 |
Wireshark: Packet Operations |
Learn the fundamentals of packet analysis with Wireshark and how to find the needle in the haystack! |
Easy
|
Walkthrough
|
 |
Introduction to SIEM |
Learn the fundamentals of SIEM and explore its features and functionality. |
Easy
|
Walkthrough
|
 |
Tempest |
You are tasked to conduct an investigation from a workstation affected by a full attack chain. |
Medium
|
Challenge
|
 |
Microsoft Windows Hardening |
To learn key attack vectors used by hackers and how to protect yourself using different hardening techniques. |
Easy
|
Walkthrough
|
 |
Security Principles |
Learn about the security triad and common security models and principles. |
Easy
|
Walkthrough
|
 |
Wireshark: Traffic Analysis |
Learn the basics of traffic analysis with Wireshark and how to find anomalies on your network! |
Medium
|
Walkthrough
|
 |
Secure Network Architecture |
Learn about and implement security best practices for network environments. |
Medium
|
Walkthrough
|
 |
Active Directory Hardening |
To learn basic concepts regarding Active Directory attacks and mitigation measures. |
Medium
|
Walkthrough
|
 |
Introduction to Cryptography |
Learn about encryption algorithms such as AES, Diffie-Hellman key exchange, hashing, PKI, and TLS. |
Medium
|
Walkthrough
|
 |
Network Security Protocols |
Learn about secure network protocols at the different layers of the OSI model. |
Medium
|
Walkthrough
|
 |
OWASP API Security Top 10 - 2 |
Learn the basic concepts for secure API development (Part 2). |
Medium
|
Walkthrough
|
 |
OWASP API Security Top 10 - 1 |
Learn the basic concepts for secure API development (Part 1). |
Medium
|
Walkthrough
|
 |
Introduction to SOAR |
Learn the concepts and methodology surrounding security orchestration, automation, and response. |
Medium
|
Walkthrough
|
 |
Splunk: The Basics |
Understand how SOC analysts use Splunk for log investigations. |
Easy
|
Walkthrough
|
 |
Intro to Cloud Security |
Learn fundamental concepts regarding securing a cloud environment. |
Easy
|
Walkthrough
|
 |
Linux System Hardening |
Learn how to improve the security posture of your Linux systems. |
Medium
|
Walkthrough
|
 |
Virtualization and Containers |
Introduction to common virtualization technologies and applications. |
Easy
|
Walkthrough
|
 |
Boogeyman 1 |
A new threat actor emerges from the wild using the name Boogeyman. Are you afraid of the Boogeyman? |
Medium
|
Walkthrough
|
 |
Vulnerability Management |
Learn how to identify, detect, mitigate and report a vulnerability effectively. |
Medium
|
Walkthrough
|
 |
DAST |
Learn about Dynamic Application Security Testing. |
Medium
|
Walkthrough
|
 |
Weaponizing Vulnerabilities |
Learn how a vulnerability evolves and methods to weaponize multiple vulnerabilities leading to RCE. |
Medium
|
Walkthrough
|
 |
Snapped Phish-ing Line |
Apply learned skills to probe malicious emails and URLs, exposing a vast phishing campaign. |
Easy
|
Challenge
|
 |
Identity and Access Management |
Learn about identification, authentication, authorisation, accounting, and identity management. |
Easy
|
Walkthrough
|
 |
Network Device Hardening |
Learn techniques for securing and protecting network devices from potential threats and attacks. |
Medium
|
Walkthrough
|
 |
Threat Modelling |
Building cyber resiliency and emulation capabilities through threat modelling. |
Medium
|
Walkthrough
|
 |
Intro to Logs |
Learn the fundamentals of logging, data sources, collection methods and principles to step into the log analysis world. |
Easy
|
Walkthrough
|
 |
Governance & Regulation |
Explore policies and frameworks vital for regulating cyber security in an organisation. |
Easy
|
Walkthrough
|
 |
Mother's Secret |
Exploit flaws found in Mother's code to reveal its secrets. |
Easy
|
Challenge
|
 |
Security Engineer Intro |
What does a day in the life of a security engineer look like? |
Easy
|
Walkthrough
|
 |
SAST |
Learn about Static Application Security Testing. |
Medium
|
Walkthrough
|
 |
Risk Management |
Learn about framing, assessing, responding, and monitoring risk. |
Easy
|
Walkthrough
|
 |
Logging for Accountability |
Learn about the role accountability plays in logging and incident response. |
Easy
|
Walkthrough
|
 |
Traverse |
Challenge your secure coding skills to restore a compromised website. |
Easy
|
Walkthrough
|
 |
Auditing and Monitoring |
Learn about auditing, monitoring, logging, and SIEM. |
Easy
|
Walkthrough
|
 |
Intro to IR and IM |
An introduction to Incident Response and Incident Management. |
Easy
|
Walkthrough
|
 |
Becoming a First Responder |
Explaining how first responders work and what to do if you are a first responder to a cyber incident. |
Info
|
Walkthrough
|
 |
Cyber Crisis Management |
An introduction into cyber crisis management and how a CMT works. |
Easy
|
Walkthrough
|
 |
Boogeyman 2 |
The Boogeyman is back. Are you still afraid of the Boogeyman? |
Medium
|
Challenge
|
 |
Boogeyman 3 |
The Boogeyman emerges from the darkness again. |
Medium
|
Challenge
|
 |
Eviction |
Unearth the monster from under your bed. |
Easy
|
Walkthrough
|
 |
Summit |
Can you chase a simulated adversary up the Pyramid of Pain until they finally back down? |
Easy
|
Challenge
|
 |
Log Operations |
Learn the operation process details. |
Easy
|
Walkthrough
|
 |
IDS Fundamentals |
Learn the fundamentals of IDS, along with the experience of working with Snort. |
Easy
|
Walkthrough
|
 |
SOC L1 Alert Triage |
Learn more about SOC alerts and build a systematic approach to efficiently triaging them. |
Easy
|
Walkthrough
|
 |
SOC L1 Alert Reporting |
Learn how to properly report, escalate, and communicate about high-risk SOC alerts. |
Easy
|
Walkthrough
|
 |
SOC Workbooks and Lookups |
Discover useful corporate resources to help you structure and simplify L1 alert triage. |
Easy
|
Walkthrough
|
 |
SOC Metrics and Objectives |
Explore key metrics driving SOC effectiveness and discover ways to improve them. |
Easy
|
Walkthrough
|
 |
Windows Logging for SOC |
Start your Windows monitoring journey by learning how to use system logs to detect threats. |
Easy
|
Walkthrough
|
 |
Windows Threat Detection 1 |
Explore common Initial Access methods on Windows and learn how to detect them. |
Medium
|
Walkthrough
|
 |
Windows Threat Detection 2 |
Discover how to detect and analyze the first steps of threat actors after breaching Windows. |
Medium
|
Walkthrough
|
 |
Detecting Web Shells |
Explore web shell detection by analyzing logs, file systems, and network traffic. |
Easy
|
Walkthrough
|
 |
File and Hash Threat Intel |
This room seeks to teach on enriching file and hash artefacts using threat intelligence. |
Easy
|
Walkthrough
|
 |
Windows Threat Detection 3 |
Learn how threat actors manage to maintain access to the breached Windows hosts. |
Medium
|
Walkthrough
|
 |
Humans as Attack Vectors |
Understand why and how people are targeted in cyber attacks and how the SOC helps defend them. |
Easy
|
Walkthrough
|
 |
Systems as Attack Vectors |
Learn how attackers exploit vulnerable and misconfigured systems, and how you can protect them. |
Easy
|
Walkthrough
|
 |
Log Analysis with SIEM |
Learn how SIEM solutions can be used to detect and analyse malicious behaviour. |
Medium
|
Walkthrough
|
 |
SOC Role in Blue Team |
Discover security roles and learn how to advance your SOC career, starting from the L1 analyst. |
Easy
|
Walkthrough
|
 |
Web Security Essentials |
Learn how the web works, common website security risks, and protections for a safer internet. |
Easy
|
Walkthrough
|
 |
Network Discovery Detection |
Understand how attackers discover assets in a network, and how to detect that activity. |
Medium
|
Walkthrough
|
 |
Linux Logging for SOC |
Explore key Linux log sources and learn how to use them in your SOC triage. |
Easy
|
Walkthrough
|
 |
IP and Domain Threat Intel |
A look into enriching IP and domain insights with open source threat intelligence. |
Medium
|
Walkthrough
|
 |
Invite Only |
Extract insight from a set of flagged artefacts, and distil the information into usable threat intelligence. |
Easy
|
Challenge
|
 |
Detecting Web Attacks |
Explore web attacks and detection methods through log and network traffic analysis. |
Easy
|
Walkthrough
|
 |
Man-in-the-Middle Detection |
Learn what MITM attack is, and how to identify the footprints of this attack in the network traffic. |
Easy
|
Walkthrough
|
 |
Linux Threat Detection 1 |
Explore how attackers break into Linux systems and how you can detect this in logs. |
Medium
|
Walkthrough
|
 |
Malware Classification |
Learn how to identify, classify, and understand common types of malware. |
Easy
|
Walkthrough
|
 |
Alert Triage With Splunk |
Use Splunk to triage alerts and investigate malicious activity efficiently. |
Medium
|
Walkthrough
|
 |
Introduction to EDR |
Learn the fundamentals of EDR and explore its features and working. |
Easy
|
Walkthrough
|
 |
Network Security Essentials |
Learn about key aspects of network security essentials and how to monitor and protect against adversaries. |
Easy
|
Walkthrough
|
 |
Detecting Web DDoS |
Explore denial-of-service attacks, detection techniques, and strategies for protection. |
Easy
|
Walkthrough
|
 |
Linux Threat Detection 2 |
Explore the first actions of attackers after breaching a Linux server and learn how to detect them. |
Medium
|
Walkthrough
|
 |
Shadow Trace |
Analyse a suspicious file, uncover hidden clues, and trace the source of the infection. |
Easy
|
Challenge
|
 |
Linux Threat Detection 3 |
Cover the last stages of attacks on Linux and learn how they look in system logs. |
Medium
|
Walkthrough
|
 |
Alert Triage With Elastic |
Investigate alerts with Elastic by analyzing logs and spotting threats. |
Medium
|
Walkthrough
|
 |
Network Traffic Basics |
Learn what network analysis is, why it is essential, how to collect network traffic and which tools are available |
Easy
|
Walkthrough
|
 |
Data Exfiltration Detection |
Learn how to detect data exfiltration attempts in various network channels. |
Medium
|
Walkthrough
|
 |
Living Off the Land Attacks |
Learn to detect and analyse Living Off the Land attacks using trusted Windows tools. |
Easy
|
Walkthrough
|
 |
OWASP Top 10 2025: IAAA Failures |
Learn about A01, A07, and A09 in how they related to failures in the applied IAAA model. |
Easy
|
Walkthrough
|
 |
OWASP Top 10 2025: Application Design Flaws |
Learn about A02, A03, A06, and A10 and how they related to design flaws in the application. |
Easy
|
Walkthrough
|
 |
OWASP Top 10 2025: Insecure Data Handling |
Learn about A04, A05, and A08 as they related to insecure data handling. |
Easy
|
Walkthrough
|
 |
Windows Internals |
Learn and understand the fundamentals of how Windows operates at its core. |
Medium
|
Walkthrough
|
 |
Tardigrade |
Can you find all the basic persistence mechanisms in this Linux endpoint? |
Medium
|
Walkthrough
|
 |
Dissecting PE Headers |
Learn about Portable Executable files and how their headers work. |
Medium
|
Walkthrough
|
 |
Sigma |
Provide understanding to Sigma, a Generic Signature Format for SIEM Systems. |
Medium
|
Walkthrough
|
 |
x86 Architecture Overview |
A crash course in x86 architecture to enable us in malware reverse engineering. |
Easy
|
Walkthrough
|
 |
x86 Assembly Crash Course |
A crash course in x86 assembly to enable us in malware reverse engineering. |
Medium
|
Walkthrough
|
 |
Intro to Detection Engineering |
Introduce the concept of detection engineering and the frameworks used towards crafting effective threat detection strategies. |
Easy
|
Walkthrough
|
 |
Aurora EDR |
Familiarise with the use of a Sigma-based EDR tool, Aurora. |
Medium
|
Walkthrough
|
 |
Tactical Detection |
Establish a baseline knowledge of tactical detection, leveraging efficient techniques to bolster your security posture. |
Medium
|
Walkthrough
|
 |
SigHunt |
You are tasked to create detection rules based on a new threat intel. |
Medium
|
Challenge
|
 |
Basic Static Analysis |
Learn basic malware analysis techniques without running the malware. |
Medium
|
Walkthrough
|
 |
MalBuster |
You are tasked to analyse unknown malware samples detected by your SOC team. |
Medium
|
Walkthrough
|
 |
Splunk: Exploring SPL |
Learn and explore the basics of the Search Processing Language. |
Medium
|
Walkthrough
|
 |
Threat Intelligence for SOC |
Learn how to utilise Threat Intelligence to improve the Security Operations pipeline. |
Medium
|
Walkthrough
|
 |
Basic Dynamic Analysis |
Learn how to analyze malware Dynamically by running them in a Virtual Machine. |
Medium
|
Walkthrough
|
 |
Atomic Red Team |
Leveraging the Atomic Red Team Framework to strengthen the Security Operations' detection capabilities. |
Medium
|
Walkthrough
|
 |
Intro to Threat Emulation |
A look into threat emulation practices as a means of cyber security assessment. |
Medium
|
Walkthrough
|
 |
Splunk: Setting up a SOC Lab |
Explore Splunk beyond basics. |
Medium
|
Walkthrough
|
 |
Anti-Reverse Engineering |
Learn the techniques used by malware authors to bypass detection. |
Medium
|
Walkthrough
|
 |
Dynamic Analysis: Debugging |
Learn more advanced techniques of dynamic malware analysis. |
Medium
|
Walkthrough
|
 |
CALDERA |
Leveraging CALDERA to emulate various adversarial activities for detection capability testing. |
Hard
|
Walkthrough
|
 |
Advanced Static Analysis |
Learn how to identify code constructs and examine the assembly code of malware. |
Medium
|
Walkthrough
|
 |
MalDoc: Static Analysis |
Perform detailed Static Analysis on malicious documents. |
Medium
|
Walkthrough
|
 |
Advanced ELK Queries |
Search large datasets efficiently with advanced queries in Kibana. |
Easy
|
Walkthrough
|
 |
Preparation |
A look into the Preparation phase of the Incident Response. |
Medium
|
Walkthrough
|
 |
Threat Intel & Containment |
Learn what threat intelligence looks like, and some containment strategies used in the IR process. |
Easy
|
Walkthrough
|
 |
Logstash: Data Processing Unit |
Learn how to collect, process and transform data with Logstash. |
Medium
|
Walkthrough
|
 |
Threat Hunting: Foothold |
Hunting suspicious activities indicating initial user or host compromise. |
Medium
|
Walkthrough
|
 |
Threat Hunting: Pivoting |
Hunting suspicious activities indicating threat propagation across the infrastructure. |
Medium
|
Walkthrough
|
 |
Custom Alert Rules in Wazuh |
Learn how to create rules in Wazuh for your environment. |
Easy
|
Walkthrough
|
 |
Splunk: Dashboards and Reports |
Creating Dashboards and Reports in Splunk. |
Easy
|
Walkthrough
|
 |
Threat Hunting: Introduction |
Behind the scenes of Threat Hunting - mindset, process, and goals. |
Easy
|
Walkthrough
|
 |
Splunk: Data Manipulation |
Learn how to parse and manipulate data in Splunk. |
Medium
|
Walkthrough
|
 |
Slingshot |
Can you retrace an attacker's steps after they enumerate and compromise a web server? |
Easy
|
Walkthrough
|
 |
Threat Hunting: Endgame |
Learn how to hunt and discover suspicious activities indicating actions on objectives. |
Medium
|
Walkthrough
|
 |
Intro to Log Analysis |
An intro to log analysis, best practices, and essential tools for effective detection and response. |
Easy
|
Walkthrough
|
 |
Identification & Scoping |
A look into the second phase of the Incident Response Framework, Identification & Scoping. |
Medium
|
Walkthrough
|
 |
Atomic Bird Goes Purple #1 |
Time to simulate hunting and detecting activities to sharpen your purple teaming skills. |
Medium
|
Walkthrough
|
 |
Atomic Bird Goes Purple #2 |
Time to simulate hunting and detecting activities to sharpen your purple teaming skills. |
Medium
|
Walkthrough
|
 |
Eradication & Remediation |
A look into the fourth phase of the Incident Response framework: Eradication, Remediation, and Recovery. |
Easy
|
Walkthrough
|
 |
Lessons Learned |
A look into the fifth phase of the Incident Response framework: Lessons Learned. |
Easy
|
Walkthrough
|
 |
Hunt Me I: Payment Collectors |
A Finance Director was recently phished. Can you hunt the logs and determine what damage was done? |
Medium
|
Walkthrough
|
 |
Fixit |
Fix the log parsing issue and analyze the logs in Splunk. |
Medium
|
Walkthrough
|
 |
Hunt Me II: Typo Squatters |
One of your software developers unknowingly installed a malicious software. Can you trace back the root cause? |
Medium
|
Walkthrough
|