SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses - Live Online
Learning how an attack works is the easy half. Knowing which control would have stopped it, and whether that control survives contact with a competent adversary, is the part most teams skip.
SEC599 spends six days of live, virtual instruction on exactly that. You compromise a fictional organization on day one, so the rest of the week has stakes, then work forward through the attack chain implementing and testing the controls that break each stage. The labs run in a browser-based environment, so nobody spends the first morning fighting a hypervisor, and the student virtual machines come with you afterward.
During the week, you'll work through:
- 20+ hands-on labs
- A full-day, team-based Capture the Flag challenge
- Atomic TTP testing with Caldera and attack surface mapping with BBOT
- NTLMv2 relay defense, ExploitGuard, and application control bypass analysis
- BloodHound attack path mapping and Kerberos attack exercises
- Threat hunting with Velociraptor and memory analysis with MemProcFS
Built by Practitioners on Both Sides
Course authors Erik Van Buggenhout and Stephen Sims wrote SEC599 after years of teaching offense to students who turned out to be defenders. The result splits roughly half prevention, a third detection, and the remainder attack emulation. 36 CPE credits, aligned to the GIAC Defending Advanced Threats (GDAT) certification.
Who Should Take This Course?
Security architects and engineers who want to know whether their controls change adversary behavior, SOC analysts and engineers focused on detection, red teamers curious about what stops them, and technical security managers deciding which controls to fund first. Comfort with Windows and Linux command lines, Active Directory, and TCP/IP is assumed.
