SEC536: Adversarial AI - Penetration Testing AI Systems
SEC536Offensive Operations, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Welcome to SEC501: Advanced Security Essentials - Enterprise Defender
Instructor: Ross Bergman | 25 Hands-On Labs | 38 CPEs | In-Person & Live Online
Gain hands-on, cross-disciplinary cyber defense skills and prepare for CERT/CSIRT roles with 25+ labs using real cyber tools for network security, malware analysis, SecOps, forensics, and more.
As cyberattacks grow more sophisticated and damaging, enterprises must adopt a comprehensive PREVENT-DETECT-RESPOND strategy to protect critical data and maintain resilient network defenses. SEC501: Advanced Security Essentials – Enterprise Defender equips security professionals with the hands-on skills and knowledge needed to audit, harden, monitor, and defend infrastructure across both on-premises and cloud environments. By strengthening prevention, enhancing detection, and streamlining incident response, organizations can reduce risk, mitigate the impact of breaches, and continuously improve their cybersecurity posture.
Prevent. Detect. Respond.
The experience of continuous adversary activity, of increasing magnitude, leading to frequent attacks, and the inevitable compromise which too often results in data loss and leakage. Enterprises must have cross-trained professionals fully prepared to contribute meaningfully to CERT/CSIRT activities when required. Experienced technologists who are exploring cyber career pathways and looking for hands-on practical experience with cutting-edge tools of the trade will find what they need in SEC501: Advanced Security Essentials-Enterprise Defender. It is the only SANS course that provides training across cybersecurity sub-disciplines in the tools and techniques used daily to defend the enterprise. Full-day course topics cover defending network architecture, penetration testing, security operations, DFIR/CERT/CSIRT, and malware analysis. Twenty five labs, conducted in-class, provide hands-on experience with real-world tools (e.g., Cisco routers, Covenant, Metasploit, Nessus, Nmap, Procmon, Snort, SOF-ELK, TShark, Wireshark, etc.) in each of these areas, demonstrating:
- active defense
- attacks against network devices (and defenses)
- digital artifact collection
- forensic data recovery
- interactive behavioral analysis of malware
- intrusion detection and Snort signature creation
- log aggregation and correlation
- manual code reversing
- network forensics
- network scanning and enumeration
- packet and protocol analysis
- password cracking
- super timeline analysis
- system exploitation and post-expolitation pivoting
- vulnerability assessment
- web application scanning and attacks
and more.
In SEC501: Advanced Security Essentials-Enterprise Defender you will
- Delve into the secrets of how Ransomware operates and what it needs to function, then find the data needed to defeat it by deceiving it into believing you have met its demands.
- Launch real-time attacks against network devices by compromising authentication, redundancy, routing protocols, and encrypted credentials, then hardening devices against these same attacks and validating that they fail.
- Discover and compromise systems, enumerate accounts, steal credentials, and discover, identify, attack, compromise, and pivot to other systems on the target network using exploitation tools and frameworks exactly as your adversary would do.
- Detect vulnerabilities with sniffers, scanners, and proxies, giving you the opportunity to remediate the weaknesses in your systems before the attack begins.
- Directly consume threat intelligence, identifying signatures of nascent attacks in packets captured from your network and creating and testing new rules for your Network Intrusion Detection System.
SEC501 Features 25 Labs That Will Show You How To
- Build a defensible network architecture by auditing router configurations, launching successful attacks against them, hardening devices to withstand those same attacks, and using active defense tools to detect an attack and generate an alert
- Perform detailed analysis of traffic using various sniffers and protocol analyzers, and automate attack detection by creating and testing new rules for detection systems
- Identify and track attacks and anomalies in network packets using multiple technologies
- Use SIEM for visualization and correlation of multi-system activity to identify and verify a data breach
- Use various tools such as vulnerability scanning and network discovery to assess systems and web applications for known vulnerabilities, and exploit those vulnerabilities using penetration testing frameworks and toolsets
- Collect digital artifacts and recover deleted data using digital forensic techniques, and analyze a supertimeline created from these artifacts to determine the vector of initial compromise
- Apply network forensic analysis to contain a Ransomware outbreak, differentiating between systems only downloading the malware, and those which executed the malware
- Find, identify, analyze, and clean up malware such as Ransomware using a variety of techniques, including monitoring the malware as it executes and manually reversing its code to discover its secrets
Author Statement
"My introduction to cybersecurity began in the early 1990s as a neuroscience Ph.D. student on the day after our lab was the victim of a cyber attack. That's when I discovered that our UNIX workstations had known vulnerabilities for which patches had to be downloaded and installed. Entirely self-taught, I learned to patch and rebuild kernels and compile, deploy, configure, and use tools like Tripwire, SATAN, and TCP Wrappers. Later, as a full-time enterprise administrator, I learned about switches, routers, and firewalls; RSA SecurID, IPSec VPN, and proxy gateways; hardening Windows endpoints; automating the auditing of Active Directory and the dynamic population of security groups; administering Nexpose; and wrangling IPTables. My own multifaceted technology background makes me particularly enthusiastic about being the lead author for SEC501. The course reflects my own experience as a jack of all trades and provides the perfect opportunity to share that excitement with you!"
- Ross Bergman
- Secure network infrastructure and harden devices
- Identify vulnerabilities through testing and assessments
- Detect threats using packet analysis and forensics
- Follow the six-step incident response process
- Analyze malware behavior and reverse code
- Use active defense and perform network forensics
- Understand attacker tactics to reduce risk
- Upskill technologists for stronger cyber defense
- Boost cybersecurity effectiveness and efficiency
- Build resilient, attack-resistant networks
- Identify and fix critical vulnerabilities
- Detect threats through system and network monitoring
- Understand attack methods across environments
While not required, it is recommended that students take SANS's SEC401: Security Essentials: Network, Endpoint, and Cloud course or have the skills taught in that class.
Important! Bring your own system configured according to these instructions.
A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.
Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.
Mandatory System Hardware Requirements
- Intel or AMD x64 CPU (2020 or later). ARM64/AArch64 and Apple M-series processors will not work are not supported.
- Virtualization enabled in BIOS/UEFI (Intel VT-x or AMD-V).
- Minimum 16 GB RAM (VMs will use up to 14 GB).
- Minimum 125 GB free storage (VMs require at least 100 GB once installed).
- Wireless networking capability (802.11) required for In-Person classes.
- Optional: A second monitor or tablet may be helpful for viewing the SEC501 Electronic Workbook during labs.
Operating System & Configuration (Mandatory)
- Windows 11 (Intel/AMD), fully patched. macOS and Linux are not supported.
- Local Administrator access required.
- Ability to disable antivirus/endpoint protection if necessary.
- Ability to disable VPN clients and host firewalls if necessary.
Corporate security controls frequently interfere with virtualization and lab networking. If you cannot modify these settings, please arrange to use a different system.
Required Pre-Class Setup
Complete before the first day of class.
From your SANS Portal:
- Download VMware Workstation, the SEC501 course media (.iso file, 15+ GB), and the SEC501 Lab Setup Instructions.
- Follow the Lab Setup Instructions fully (may take 60+ minutes).
- For In-Person/Live Online classes: Install Slack and join the SANS Training workspace and the SEC501 class channel.
Pricing & Registration
This course is part of the SANS Partnership Program. Eligible Attendees from North American State/ Local Government, State/ Local Law Enforcement, Universities / Colleges and K12 Schools may enroll to attend this course in-person or online at a discounted rate of $3725.00 per attendee. Please click the respective registration button below to enroll.
This class is Live Online only, please click the "Register Now" button below. If you are affiliated with a Partnership-eligible institution enter discount code StateOfKansasLO to receive your Partnership pricing!
Please note that this links will take you to the login page for a SANS account. If you have a SANS account, please enter your Username and Password to register for the class. If you do not have a SANS account, you will need to create one before registering.
In this course section we will discuss published security benchmarks, vendor guidance to secure various products, and regulatory requirements and how they impact defending infrastructure against specific attacks.
Topics covered
- Security Standards and Audit
- Authentication, Authorization, and Accounting
- Defending Network Infrastructure
Labs
- Initial Router Configuration and Audit
- Securing AAA
- Securing Redundancy Protocols
Overview
Proper design and configuration of network devices protects both the components being configured and the rest of the enterprise that depends on those devices to defend other components from attacks. In other words, a good house needs a good foundation!
In this course section we will discuss published security benchmarks, vendor guidance to secure various products, and regulatory requirements and how they impact defending infrastructure against specific attacks. To illustrate these points, we will look in detail at securing and defending a router infrastructure against a number of device-and network-based attacks. Securing private and public cloud infrastructure against common attacks will also be discussed.
Full Lab Details
- Initial Router Configuration and Audit
- Securing AAA
- Securing Redundancy Protocols
- Log Infrastructure in Defense
- Defending Routing Protocols
- Final Router Hardening Steps/Audit
Full Topic Details
- Security Standards and Audit
- Authentication, Authorization, and Accounting
- Defending Network Infrastructure
- Name Resolution Attacks and Defense
- Securing and Defending Private and Public Cloud Infrastructure
This course section will present the variety of tests that can be run against an enterprise, and show how to perform effective penetration tests to better understand the security posture for network services, operating systems, and applications.
Topics covered
- Penetration Testing Scoping and Rules of Engagement
- Open-Source Intelligence
- Social Engineering
Labs
- Network Scanning Fundamentals
- Scanning with Nessus
- Exploitation and Metasploit Basics
Overview
Security is all about understanding, mitigating, and controlling the risk to an enterprise's critical assets. An enterprise must understand the changing threat landscape and have the capacity to compare it against its own vulnerabilities that could be exploited to compromise the environment. This course section will present the variety of tests that can be run against an enterprise, and show how to perform effective penetration tests to better understand the security posture for network services, operating systems, and applications. In addition, we will talk about social engineering and open-source intelligence activities to better emulate increasingly prevalent threats to users.
Finding basic vulnerabilities is easy but not necessarily effective if these are not the vulnerabilities attackers exploit to break into a system. Advanced penetration testing involves understanding the variety of systems and applications on a network and how they can be compromised by an attacker. Students will learn to scope and plan their test projects, perform external and internal network penetration testing and web application testing, and pivot through the environment like real-world attackers. And while penetration testing is critical to identify an enterprise's exposure points, students will also learn how to prioritize and fix these vulnerabilities to increase the enterprise's overall security.
Full Lab Details
- Network Scanning Fundamentals
- Scanning with Nessus
- Exploitation and Metasploit Basics
- Post-Exploitation and Pivoting
- Basic Web App Scans and Attacks
Full Topic Details
- Penetration Testing Scoping and Rules of Engagement
- Open-Source Intelligence
- Social Engineering
- Network Mapping and Scanning Techniques
- Enterprise Vulnerability Scanning
- Network Exploitation Tools and Techniques
- Post-Exploitation and Pivoting
- Web Application Exploitation Tools and Techniques
- Reporting and Debriefing
This course section will start with a brief introduction to network security monitoring, followed by a refresher on network protocols, with an emphasis on fields to look for as security professionals.
Topics covered
- Network Security Monitoring
- Advanced Packet Analysis
- Network Intrusion Detection/Prevention
Labs
- Analyzing PCAPs with tcpdump
- Attack Analysis with Wireshark
- Snort Basics
Overview
Traffic analysis and intrusion detection used to be treated as a separate discipline within many enterprises. Today, prevention, detection, and response must be closely knit, so that once an attack is detected, defensive measures can be adapted and proactive forensics implemented so the enterprise can continue to operate. This course section will start with a brief introduction to network security monitoring, followed by a refresher on network protocols, with an emphasis on fields to look for as security professionals. We will use tools such as tcpdump and Wireshark to analyze packet traces and look for indicators of attacks. We will also use a variety of detection and analysis tools as well as explore Snort as a Network Intrusion Detection System and examine rule signatures in-depth., Students will also conduct network forensics, and make use of the SOF-ELK platform to demonstrate the power of Security Information and Event Management tools.
Full Lab Details
- Analyzing PCAPs with tcpdump
- Attack Analysis with Wireshark
- Snort Basics
- Detecting Malicious Activity with Security Onion
- Security Analytics with SOF-ELK
Full Topic Details
- Network Security Monitoring
- Advanced Packet Analysis
- Network Intrusion Detection/Prevention
- Writing Signatures for Detection
- Network Forensics and More
- Event Management Introduction
- Continuous Monitoring
- Logging and Event Collection and Analysis
- SIEM and Analytics
Students will learn how incident response currently operates, after years of evolving, in order to address the dynamic procedures used by attackers to conduct their operations.
Topics covered
- Active Defense
- DFIR Core Concepts
- Scaling and Scoping
Labs
- Active Defense: Honeypots
- Data Recovery with FTK Imager and Photorec
- Discovering Artifacts
Overview
Enterprises rely on their CERT/CSIRT to find, scope, contain, and eradicate evil from their networks. Incident investigators employ DFIR practices to determine what happened: DFIR teams conduct investigations to find evidence of compromise, remediate the environment, and provide data to generate local threat intelligence for operations teams in order to continuously improve detection. While traditionally seen as a finite process, incident response is now viewed as ongoing, with DFIR professionals searching for evidence of an attacker that has existed in the environment without detection by applying new threat intelligence to existing evidence. This is the crux of the concept known as "threat hunting."
This section begins with a discussion of Active Defense approaches in some detail, then presents the core concepts of DFIR. We will explore some of the hundreds of artifacts that can give forensic investigators specific insight about what occurred during an incident. Students will learn how incident response currently operates, after years of evolving, in order to address the dynamic procedures used by attackers to conduct their operations. We will also look at how to integrate DFIR practices into a continuous security operations program. Next, a cyclical, six-step incident response process is presented. Each step will be examined in detail, including practical examples of how to apply it. Finally, students will learn about the artifacts that can best be used to determine the extent of suspicious activity within a given environment and how to migrate techniques to a large data set for enterprise-level analysis.
Full Lab Details
- Active Defense: Honeyports
- Data Recovery with FTK Imager and Photorec
- Discovering Artifacts
- Ransomware Timeline Analysis of Ransomware
- Ransomware Network Analysis of Ransomware
Full Topic Details
- Active Defense
- DFIR Core Concepts: Digital Forensics
- DFIR Core Concepts: Incident Response
- Modern Digital Forensics & Incident Response
- Widening the Net: Scaling and Scoping
In this course section, we will define each of the most popular types of malware and walk through multiple examples. The four primary phases of malware analysis will be covered: Fully Automated Analysis, Static Properties Analysis, Interactive Behavior Analysis, and Manual Code Reversing.
Topics covered
- Intro to Malware Analysis
- Malware Analysis Stages
Labs
- Static Properties Analysis of Ransomware
- Interactive Behavior Analysis of Ransomware
Overview
Malicious software is responsible for many incidents in almost every type of enterprise. Types of malware vary widely, from Ransomware and Rootkits to Crypto Currency Miners and Worms. In this course section, we will define each of the most popular types of malware and walk through multiple examples. The four primary phases of malware analysis will be covered: Fully Automated Analysis, Static Properties Analysis, Interactive Behavior Analysis, and Manual Code Reversing. Students will complete various in-depth labs requiring them to fully dissect a live Ransomware specimen from static analysis through code analysis. They will also gain hands-on experience with manipulating the malware through behavior analysis techniques, and in decrypting files encrypted by Ransomware by extracting the keys through reverse engineering. All steps are well defined and tested to ensure that the process to achieve these goals is actionable and digestible.
Full Lab Details
- Static Properties Analysis of Ransomware
- Interactive Behavior Analysis of Ransomware - Part I
- Interactive Behavior Analysis of Ransomware - Part II
- Manual Code Reversing of Ransomware
Full Topic Details
- Introduction to Malware Analysis
- Malware Analysis Stages: Fully Automated and Static Properties Analysis
- Malware Analysis Stages: Interactive Behavior Analysis
- Malware Analysis Stages: Manual Code Reversing
This final course section will serve as a real-world challenge for students by requiring them to work in teams, use the skills they have learned throughout the course, think outside the box, and solve a range of problems from simple to complex.
Overview
A web server scoring system and Capture-the-Flag engine will be provided to score students as they submit flags to score points. More difficult challenges will be worth more points. In this defensive exercise, challenges include packet analysis, malware analysis, and other challenges related to the course material.