Talk With an Expert

SEC504: Hacker Tools, Techniques, and Incident Handling

SEC504Offensive Operations
  • 6 Days (Instructor-Led)
  • 38 Hours (Self-Paced)
Course created by:
Joshua Wright
Joshua Wright
SEC504: Hacker Tools, Techniques, and Incident Handling
Course created by:
Joshua Wright
Joshua Wright
  • GIAC Certified Incident Handler Certification (GCIH)
  • 38 CPEs

    Apply your credits to renew your certifications

  • In-Person, Virtual or Self-Paced

    Attend a live, instructor-led class at a location near you or remotely, or train on your time over 4 months

  • 30 Hands-On Lab(s)

    Apply what you learn with hands-on exercises and labs

Transform your incident response skills; think like an attacker as you investigate cybersecurity incidents, develop threat intelligence, and apply defense strategies against real-world threats.

Course Overview

SEC504 training is our flagship incident handling course that equips you with essential incident response skills to detect, respond to, and neutralize threats across Windows, Linux, and cloud platforms. With a focus on hands-on learning, you'll engage in immersive labs to simulate real-world breaches, enhancing your ability to think like an attacker and improve your organization's security posture. This course provides practical skills in Cyber Threat Intelligence (CTI) and threat defense strategies that can be applied immediately.

What You’ll Learn

  • Respond effectively to incidents to limit damage
  • Evaluate breach evidence to determine compromise scope
  • Identify shadow cloud systems and other potential threats
  • Use attack tools to assess cloud and on-premises exposure
  • Apply defenses to enhance security and stop attacks
  • Test defense tools for effectiveness
  • Develop threat intelligence by analyzing attacker tactics

Business Takeaways

  • Adopt a dynamic and holistic incident response strategy
  • Strengthen cloud security posture
  • Leverage automation and AI to accelerate response
  • Understand and counter advanced attacker tactics
  • Protect critical assets with proactive defense strategies
  • Enhance threat detection with multi-layered analysis

Course Syllabus

Explore the course syllabus below to view the full range of topics covered in SEC504: Hacker Tools, Techniques, and Incident Handling.

Section 1Incident Response and Cyber Investigations

The first section covers building an incident response process using the Dynamic Approach to Incident Response (DAIR) to verify, scope, contain, and remediate threats. Through hands-on labs and real-world examples, you’ll apply this method with tools like PowerShell and learn to accelerate analysis using generative AI without compromising accuracy.

Topics covered

  • Incident Response
  • Live Examination
  • Network Investigations
  • Memory Investigations
  • Malware Investigations

Labs

  • Live Windows examination
  • Network Investigation
  • Memory Investigation
  • Malware Investigation
  • WordPress Log Assessment

Section 2Scanning and Enumeration Attacks

This section explores attacker reconnaissance techniques, including open-source intelligence, network scanning, and target enumeration to identify security gaps. You’ll apply these tactics on Windows, Linux, Azure, and AWS targets, then analyze logs and evidence to detect attacks in real time.

Topics covered

  • MITRE ATT&CK® Framework Introduction
  • Network and Host Scanning with Nmap
  • Cloud Spotlight: Cloud Scanning
  • Server Message Block (SMB) Security
  • Defense Spotlight: Hayabusa and Sigma Rules

Labs

  • Host Discovery and Assessment with Nmap
  • Shadow Cloud Asset Discovery with Masscan
  • Windows Server Message Block (SMB) Security Investigation
  • Windows Password Spray Attack Detection
  • The Many Uses of Netcat

Section 3Password Attacks and Exploit Frameworks

This section covers key techniques for password compromises on on-premises and cloud systems, using tools like Legba, Hashcat, and Metasploit to simulate attacks and strengthen defenses. The insights gained help enhance practical defenses and inform incident response strategies.

Topics covered

  • Password Attacks
  • Microsoft 365 Attacks
  • Understanding Password Hashes
  • Password Cracking
  • Metasploit Framework

Labs

  • Using Legba for Password Guessing and Spray Attacks
  • Bypassing Microsoft 365 authentication defenses with Amazon AWS
  • Password Cracking with Hashcat
  • Metasploit Attack and Analysis
  • Client-side Exploitation with the Browser Exploitation Framework (BeEF)

Section 4Web Application Attacks

In this course section we'll begin our look at target exploitation frameworks that take advantage of weaknesses on public servers and client-side vulnerabilities.

Topics covered

  • Forced Browsing and IDOR
  • Command Injection
  • Cross-Site Scripting (XSS)
  • SQL Injection
  • Cloud Spotlight: SSRF and IMDS Attacks

Labs

  • Forced Browsing and Insecure Direct Object Resource (IDOR) Attack
  • Command Injection Attack
  • Cross-Site Scripting Attack
  • SQL Injection Attack
  • Server-Side Request Forgery (SSRF) and Instance Metadata Service (IMDS) Attack

Section 5Evasion and Post-Exploitation Attacks

This section covers advanced post-exploitation tactics, teaching how attackers bypass protections, establish persistence, and exfiltrate data from internal networks and vulnerable cloud deployments. You'll build analysis skills to detect and respond to these threats and apply them in real-world scenarios, preparing for long-term success and certification.

Topics covered

  • Endpoint Security Bypass
  • Pivoting and Lateral Movement
  • Hijacking Attacks
  • Establishing Persistence
  • Defense Spotlight: Real Intelligence Threat Analytics

Labs

  • Endpoint Protection Bypass: Bypassing Application Allow Lists
  • Pivoting and Lateral Movement with Command & Control Frameworks
  • Exploiting Windows as A Network Insider with Responder
  • Establishing Persistence with Metasploit
  • Network Threat Hunting with Real Intelligence Threat Analytics (RITA)

Section 6Capture-the-Flag Event

Our Capture-the-Flag event is a full day of hands-on activity that has you working as a consultant for ISS Playlist, a fictitious company that has recently been compromised.

Things You Need To Know

Relevant Job Roles

All-Source Analyst (DCWF 111)

DoD 8140: Intelligence (Cyberspace)

Analyzes data from multiple sources to prepare environments, respond to information requests, and support intelligence planning and collection requirements.

Explore learning path

Target Digital Network Analyst (DCWF 132)

DoD 8140: Cyber Effects

Performs advanced analysis of collection and open-source data to track target activity, profile cyber behavior, and support cyberspace operations.

Explore learning path

Cyber Defense Analyst (DCWF 511)

DoD 8140: Cybersecurity

Monitors cyber defense tools like IDS and logs to analyze network events, identifying and mitigating potential threats to security environments.

Explore learning path

Course Schedule & Pricing

Looking for Group Purchase Options?Contact Us
Filter by:
  • Location & instructor

    Virtual (OnDemand)

    Instructed by Joshua Wright
    Date & Time
    OnDemand (Anytime)Self-Paced, 4 months access
    Course price
    $8,780 USD*Prices exclude applicable local taxes
    Registration Options
  • Location & instructor

    Amsterdam, NL & Virtual (live)

    Instructed by Chris Dale
    Date & Time
    Fetching schedule..View event details
    Course price
    €8,230 EUR*Prices exclude applicable local taxes
    Registration Options
  • Location & instructor

    Anaheim, CA, US & Virtual (live)

    Instructed by Ron Hamann
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,780 USD*Prices exclude applicable local taxes
    Registration Options
  • Location & instructor

    Huntsville, AL, US & Virtual (live)

    Instructed by Chris Pizor
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,780 USD*Prices exclude applicable local taxes
    Registration Options
  • Location & instructor

    London, GB & Virtual (live)

    Instructed by Jerome Dossogne
    Date & Time
    Fetching schedule..View event details
    Course price
    £7,160 GBP*Prices exclude applicable taxes | EUR price available during checkout
    Registration Options
  • Location & instructor

    San Antonio, TX, US & Virtual (live)

    Instructed by Ron Hamann
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,780 USD*Prices exclude applicable local taxes
    Registration Options
  • Location & instructor

    Singapore, SG

    Instructed by Anurag Khanna
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,900 USD*Prices exclude applicable local taxes
    Registration Options
  • Location & instructor

    Boston, MA, US & Virtual (live)

    Instructed by Joshua Wright
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,780 USD*Prices exclude applicable local taxes
    Registration Options
Showing 8 of 52

Benefits of Learning with SANS

Instructor teaching to a class

Get feedback from the world’s best cybersecurity experts and instructors

OnDemand Mobile App

Choose how you want to learn - online, on demand, or at our live in-person training events

Resources

Get access to our range of industry-leading courses and resources