What You Will Learn

Building Enterprise Cyber Defense: From Threat Analysis to Purple Team Implementation

You just got hired to help our virtual organization "SYNCTECHLABS" build out a cyber security capability. On your first day, your manager tells you: "We looked at some recent cyber security trend reports and we feel like we've lost the plot. Advanced persistent threats, ransomware, denial of service... We're not even sure where to start!"

Cyber threats are on the rise: ransomware tactics are affecting small, medium, and large enterprises alike, while state-sponsored adversaries are attempting to obtain access to your most precious crown jewels. SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses will arm you with the knowledge and expertise you need to overcome today's threats. Recognizing that a prevent-only strategy is not sufficient, we will introduce security controls aimed at stopping, detecting, and responding to your adversaries. This course is also a key resource for preparing for the GDAT certification, which validates your ability to build a defense-in-depth strategy against sophisticated threats.

Course authors Stephen Sims and Erik Van Buggenhout (both certified as GIAC Security Experts) are hands-on practitioners who have built a deep understanding of how cyber-attacks work through penetration testing and incident response. While teaching penetration testing courses, they were often asked the question: "How do I prevent or detect this type of attack?" Well, this is it! SEC599 gives students real-world examples of how to prevent attacks. The course features more than 20 labs plus a final Capture-The-Flag exercise where students can showcase their new technical skills and compete for the coveted SEC599 Challenge Coin.

Our six-part journey will start off with an analysis of recent attacks through in-depth case studies. We will explain what types of attacks are occurring and introduce formal descriptions of adversary behavior such as the Cyber Kill Chain and the MITRE ATT&CK framework. In order to understand how attacks work, you will also compromise our virtual organization "SYNCTECHLABS" in section one exercises.

In sections two, three, four and five we will discuss how effective security controls can be implemented to prevent, detect, and respond to cyber attacks. The topics to be addressed include:

Leveraging MITRE ATT&CK as a "common language" in the organization
Using online Sandboxes and YARA rules to quickly analyze malware
Developing effective group policies to improve script execution (including PowerShell, Windows Script Host, VBA, HTA, etc.)
Highlighting key bypass strategies for script controls (Unmanaged Powershell, AMSI bypasses, etc.)
Stopping 0-day exploits using ExploitGuard and application whitelisting
Highlighting key bypass strategies in application whitelisting (focus on AppLocker)
Detecting and preventing malware persistence
Leveraging the Elastic stack as a central log analysis solution
Detecting and preventing lateral movement through Sysmon, Windows event monitoring, and group policies
Blocking and detecting command and control through network traffic analysis
Leveraging threat intelligence to improve your security posture

After a full 5-day course you will compete in a Capture-The-Flag challenge where you can apply your newly learned skills against real-world inspired cases. Your network has been compromised, so the faster you can figure out what’s going on, the higher you will score!

"SEC599 has fantastic labs and walkthroughs of present day offensive techniques and defensive options. I like how there are topics that can help a broad base of environments from the "basics" (e.g. set simple and straightforward policies and configuration) to the more "advanced" (e.g. honeypots and canaries) for various security maturity levels." - Michael Ebrahimi, Accenture

Business Takeaways

Faster threat detection and response
Stronger red and blue team collaboration
Defense based on real attacker behaviors
Better use of existing security tools
Clear metrics for measuring improvements

Skills Learned

Leverage MITRE ATT&CK for threat-informed defense
Deploy custom security controls and sandboxing
Implement advanced Windows hardening and detection
Build logging and monitoring with Elastic and Sysmon
Design threat detection using intel and traffic analysis
Practice purple teaming with real-world attack scenarios

Hands-On Purple Team Training

SEC599’s lab environment allows attendees to complete the 20+ lab exercises in the course within a full-fledged browser environment. This setup eliminates potential issues with student laptops and maximizes learning time focused on security topics rather than configuring virtual machines. Student virtual machines are provided to facilitate continued learning at home.

Examples of the practical labs and exercises you will complete in this course will enable you to:

Use MITRE ATT&CK Navigator to assess different techniques
Leverage MITRE ATT&CK as a "common language" within the organization
Harden domain environments using Security Compliance Toolkit (SCT) and Security Technical Implementation Guide (STIG)
Perform atomic TTP testing using Caldera
Map attack surfaces with BBOT
Stop NTLMv2 sniffing and relay attacks in Windows
Block typical phishing payload execution
Restrict binary and PowerShell execution
Detect threats using Sysmon and SIGMA
Utilize online sandboxes and YARA for analysis
Implement exploit mitigation using compile-time controls and ExploitGuard
Detect persistence using Autoruns and Osquery
Map attack paths using BloodHound
Implement Local Administrator Password Solution (LAPS)
Harden Windows against credential compromise
Detect lateral movement in Active Directory
Defend against ransomware
Leverage threat intelligence with MISP and Thor Lite
Hunt your environment using Velociraptor
Find malware using MemProcFS

What You Will Receive

MP3 audio files of the complete course lecture
Digital Download Package that includes:
Virtual machines for training
Electronic Courseware
Download link to the target VMs

Syllabus (36 CPEs)

Download PDF

Introduction and Reconnaissance
Overview
Begin your journey with real-world attack analysis and hands-on experience compromising the SYNCTECHLABS virtual environment. Learn to leverage the Cyber Kill Chain and MITRE ATT&CK framework while understanding purple team methodologies and essential defensive tools.
Exercises
- One click is all it takes... Initial compromise simulation
- Hardening our domain using SCT and STIG
- Kibana, ATT&CK Navigator
- Atomic TTP testing using Caldera
- Attack Surface Mapping with BBOT
Topics
- Course objectives and lab environment setup
- Analysis of current cyber-attack landscapes
- Extended Kill Chain methodology
- Purple team concepts and implementation
- MITRE ATT&CK framework integration
- Attack Surface Mapping with BBOT
Payload Delivery and Execution
Overview
Explore attacker techniques for payload delivery and execution, focusing on prevention and detection methods. Learn to implement controls against malicious executables and scripts, while gaining hands-on experience with YARA for payload description and SIGMA for use-case documentation.
Exercises
- Stopping NTLMv2 Sniffing and Relay Attacks in Windows
- Blocking Typical Phishing Payload Execution
- Restricting Binary/PowerShell Execution
- Detection with Sysmon and SIGMA
Topics
- Common delivery mechanism analysis
- Payload delivery prevention strategies
- Network and removable media controls
- Mail security and web proxy implementation
Exploitation, Persistence, and Command and Control
Overview
Learn to integrate security into the software development lifecycle while implementing effective exploit mitigation techniques. Focus on both compile-time and run-time protections, persistence detection strategies, and command and control channel identification.
Exercises
- Exploit Mitigation Using Compile-Time Controls
- Exploit Mitigation Using Exploit Guard
- Catching Persistence Using Autoruns and Osquery
- Detecting C2 Channels
Topics
- Software development lifecycle security integration
- Patch management strategies
- Exploit mitigation techniques
- Persistence strategy analysis
Lateral Movement
Overview
Focus on defending against lateral movement. Examine credential protection, Windows privilege escalation, and various attack strategies while implementing effective detection and deception techniques.
Exercises
- Mapping Attack Paths Using BloodHound
- Implementing LAPS
- Local Windows Privilege Escalation Techniques
- Hardening Windows against Credential Compromise
- Kerberos Attack Strategies
Topics
- Active Directory and Entra ID security fundamentals
- Principle of Least Privilege and UAC
- Privilege escalation prevention
- Credential theft protection
- Attack path mapping using BloodHound
Action on Objectives, Threat Hunting, and Incident Response
Overview
Address final attack stages including domain dominance prevention and data exfiltration detection. Learn to leverage threat intelligence effectively and perform incident response, with hands-on practice using advanced forensics tools.
Exercises
- Domain Dominance
- Defending against Ransomware
- Leveraging Threat Intelligence with MISP and Thor Lite
- Hunting Your Environment Using Velociraptor
- Finding Malware Using MemProcFS
Topics
- Domain dominance prevention strategies
- Data exfiltration detection methods
- Threat intelligence implementation
- Proactive threat hunting
- Incident response procedures
Capture-The-Flag Challenge
Overview
Apply your newly acquired skills in a comprehensive, team-based Capture-The-Flag competition. Your environment is under attack and it’s up to you to identify how they got in, and what they’re doing once they obtained access.
Topics
- Practical exercises based on real-world cases
- Analyze identified malware
- Perform network analysis to identify intrusions
- Examine memory captures to identify artefacts
- Find potential attack paths in your environment

GIAC Defending Advanced Threats

The GIAC Defending Advanced Threats (GDAT) certification covers both offensive and defensive topics in-depth. GDAT-certified professionals have a thorough understanding of how advanced cyber adversaries operate and how the IT environment can be improved to better prevent, detect, and respond to incidents.

Advanced persistent threat models and methods
Detecting and preventing payload deliveries, exploitation, and post-exploitation activities
Using cyber deception to gain intelligence for threat hunting and incident response
Adversary Emulation

More Certification Details

Prerequisites

Experience with Linux and Windows from the command line (including PowerShell)
Familiarity with Windows Active Directory concepts
A baseline understanding of cyber security topics
A solid understanding of TCP/IP and networking concepts

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

MANDATORY SEC599 SYSTEM HARDWARE REQUIREMENTS

CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
CRITICAL: Apple Silicon devices cannot perform the necessary virtualization and therefore cannot in any way be used for this course.
BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
8GB of RAM or more is required.
75GB of free storage space or more is required.
At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

MANDATORY SEC599 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS

Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
Microsoft Office (any version) or OpenOffice installed on your host. Note that you can download Office Trial Software online (free for 30 days).
Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts), or VMWare Fusion Pro 12.2+ or VMware Fusion Player 11.5+ (for macOS hosts) prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Workstation Player offers fewer features than VMware Workstation Pro. For those with Windows host systems, Workstation Pro is recommended for a more seamless student experience.
On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact support.

Author Statement

"After writing and teaching many advanced penetration testing and exploit development courses over the past 10 years, I started to see a trend developing. Often, over half of the students in my classes were not actually penetration testers or those who would be writing zero-days. In fact, they most often worked in a defensive role and were coming to these courses to learn about the techniques used by attackers so that they could better defend their networks. This led to our idea to write a course that focused on teaching just enough of the offense to demonstrate the impact, and then focus the majority of the time on implementing controls to break the techniques used by adversaries and red team testers."

– Erik Van Buggenhout

"SEC599 gave me interesting insight into Exploit Guard that will certainly drive great conversation at work. Best labs of any class I've taken." - Jeremiah Hainly, The Hershey Company

Ways to Learn

OnDemand

Cybersecurity learning – at YOUR pace! OnDemand provides unlimited access to your training wherever, whenever. All labs, exercises, and live support from SANS subject matter experts included.

Live Online

The full SANS experience live at home! Get the ultimate in virtual, interactive SANS courses with leading SANS instructors via live stream. Following class, plan to kick back and enjoy a keynote from the couch.

View Available Dates & Time Zones

In Person (6 days)

Did someone say ALL-ACCESS? On-site immersion via in-classroom course sessions led by world-class SANS instructors fill your day, while bonus receptions and workshops fill your evenings.

View Available Dates & Locations

Who Should Attend SEC599?

Security architects and security engineers who want to better understand how the defenses they put in place make an impact on adversary operations
Red teamers and penetration testers who want to better understand how blue team techniques could stop their attacks
Technical security managers who want to understand what security controls should be prioritized
Security Operations Center analysts and engineers who want to better understand how they can detect adversary techniques
Individuals looking to better understand how persistent cyber adversaries operate and how the IT environment can be improved to better prevent, detect, and respond to incidents.

NICE Framework Work Roles:

Adversary Emulation Specialist / Red Teamer (OPM 541)
Target Developer (OPM 131)
Cyber Ops Planner (OPM 332)
Partner Integration Planner (OPM 333)

"SEC599 is an excellent course. Every tool, technique, and process discussed during the course can be applied to real-world environments with little additional information required, and there isn't a single thing learned that can't be used to improve the cyber security position of clients." - Mac Connolly

See prerequisites

Courses

Hands-On Simulations

Certifications

Ways to Train

Training Events & Summits

Free Training Events

Security Awareness

By Focus Area

By NICE Framework

DoDD 8140 Work Roles

By European Skills Framework

By Skills Roadmap

New to Cyber

Leadership

Degree and Certificate Programs

Watch & Listen

Read

Download

SANS Community Benefits

CISO Network

Team Development

Leadership Development

Security Awareness

Public Sector Partnerships

Sponsorship Opportunities

SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses

GIAC Defending Advanced Threats (GDAT)

Course Authors:

Erik Van Buggenhout

Stephen Sims

What You Will Learn

Building Enterprise Cyber Defense: From Threat Analysis to Purple Team Implementation

Business Takeaways

Skills Learned

Hands-On Purple Team Training

What You Will Receive

Syllabus (36 CPEs)

Introduction and Reconnaissance

Overview

Exercises

Topics

Payload Delivery and Execution

Overview

Exercises

Topics

Exploitation, Persistence, and Command and Control

Overview

Exercises

Topics

Lateral Movement

Overview

Exercises

Topics

Action on Objectives, Threat Hunting, and Incident Response

Overview

Exercises

Topics

Capture-The-Flag Challenge

Overview

Topics

GIAC Defending Advanced Threats

Prerequisites

Laptop Requirements

MANDATORY SEC599 SYSTEM HARDWARE REQUIREMENTS

MANDATORY SEC599 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS

Author Statement

Ways to Learn

Who Should Attend SEC599?

Filters:

Register for SEC599

Loading...