SEC501: Applied Cyber Defense

Overview

Privileged activity may be recorded by a network device, authentication service, and Syslog server at different times and with different detail. The defender must establish what each system generated and retained before placing the records on one timeline.

Network devices provide a concrete model for records and controls distributed throughout an enterprise. A provider-managed service, build process, or AI agent can also change a system under approved authority. Records from the affected system must be compared with the approval and workflow records before the change is attributed to the approved workflow or agent.

Full Lab Details

• Configuration Baseline and Audit. Compare the current device configuration with a recognized benchmark, prioritize the exposure that warrants correction, and retain the baseline needed to measure later changes.
• Record Delivery and Time Integrity. Trace one event from the device to the receiving system and determine whether timestamp differences make the records unsafe to correlate during an incident.
• Administrative Access Records. Compare the records kept locally with centralized authentication and accounting. Determine which account received access, what the device retained, and which details would be missing during an investigation.
• Gateway Trust and Availability. Demonstrate how an untrusted peer can influence gateway selection, then verify that authentication prevents the same change and produces records for an availability investigation.
• Routing Trust. Disrupt a routing relationship with unauthenticated traffic, then verify that authenticated peers reject the traffic without creating a false route change.
• Low-Noise Connection Alerts. Convert connections to unused services into alerts that justify targeted review without adding routine service traffic to the queue.
• DNS Control and Investigation. Compare current and historical DNS records, test a sinkhole decision, and generate a decoy lookup that identifies the system requiring review.
• Hardening Evidence. Re-audit the configuration to verify which findings were corrected, which exceptions remain, and whether the final configuration contains each approved correction.

Full Topic Details

• Persistent Anomaly and Enterprise Records. Network availability, privileged access, and DNS records begin the investigation that continues across all five sections.
• Configuration Baselines and Audit Evidence. Published benchmarks, saved configurations, approved exceptions, and change records establish the state a defender expects to find on the network device.
• Logging and Time Integrity. Network device and Syslog records expose what was generated, received, normalized, and retained for later comparison.
• Administrative Access and AAA. Local device logs, RADIUS records, and command accounting describe different parts of administrative access.
• Network Trust. HSRP and OSPF show how unauthenticated peers can influence availability and how authentication changes both behavior and the records produced.
• Active Defense. Honeyports, DNS sinkholes, and decoy records create low-noise events for comparison with routine traffic.
• Software Supply Chain and Automated Change. Compare package, build, workflow, and endpoint records when an approved process or AI agent produces the change found on an affected system.
• Hardening and Final Audit. Compare the final configuration with the opening baseline, then document each correction and approved exception.

Overview

An alert may remain available after the packet or host record that produced it is no longer retained. A dashboard may expose only the fields selected by another team or provider. The defender must establish what the enterprise retained before using the alert to widen scope or escalate.

An MSSP may hold the alert while the customer retains the packet, authentication event, or host record needed to interpret it. The responder must know who can retrieve each record and who can escalate or contain the activity.

Full Lab Details

• Packet Evidence. Isolate the traffic relevant to an investigation and use the captured header fields to document what the record supports before expanding scope.
• Reconstructing Network Activity. Reassemble conversations, recover transferred content, and convert packets into searchable records that expose the activity sequence, systems, and services for further investigation.
• Testing Detection Logic. Compare each alert with the packet that produced it, then build and test a local rule against observed behavior before relying on it for escalation.
• Correlating Enterprise Records. Compare authentication events with network flow during the same period to determine whether the combined activity changes incident scope.

Full Topic Details

• Security Operations and Alert Triage. Identify who owns the alert, inspect the source record, and determine whether the responder has authority to escalate or act.
• Network Visibility Architecture. Examine how sensor placement, encryption, edge devices, and provider access determine which traffic records exist.
• Packet Analysis with tcpdump. Use header fields and readable filters to isolate the traffic needed for review.
• Wireshark and Network Forensics. Reassemble conversations, inspect protocol behavior, and extract transferred objects from packet captures.
• Zeek and Flow Analysis. Turn packet captures into searchable protocol logs and compare them with flow records that cover a larger environment.
• Suricata Detection. Inspect alert records, match them to packet fields, and build a local rule from observed traffic.
• Testing Detection Logic. Start with behavior the enterprise records, then verify that the rule identifies the intended traffic under expected conditions.
• Managed Detection and AI-Assisted Triage. Identify which records reach the MSSP or AI-assisted workflow, which remain with the customer or provider, and who has authority to act.
• SIEM Analytics. Correlate Syslog and flow records across time and endpoints to assess whether an alert changes incident scope.

Overview

Hardening begins with the systems and services that answer today, including those missing from the inventory or reachable through an exposed credential. A scanner result becomes a corrective priority after reachability, usable access, and business function have been validated.

Controlled automation closes the section with one low-impact change. Records from the preview, each target, and the repeated run show whether the approved change was applied consistently without altering systems that already matched the requested state.

Full Lab Details

• Asset and Service Discovery. Reconcile documented assets with the services that answer on the network, then identify which unexpected services require validation and corrective action.
• Vulnerability Validation. Determine whether a scanner finding provides usable access, inspect the records created on the target, and separate confirmed exposure from AI-assisted interpretation before assigning remediation priority.
• Identity Exposure. Determine whether captured credential material can be recovered and reused for administrative access, then identify the accounts and systems that require further review or containment.
• Command-and-Control Visibility. Generate controlled command activity, then determine whether the network records identify the channel and affected host well enough to support detection and scoping.
• Controlled Configuration Change. Preview and verify one low-impact change on Windows and Linux targets, then determine whether a second run changes a system that already matches the requested state.

Full Topic Details

• Asset Discovery and Inventory. Compare documented assets with the systems and services that respond when they are checked from the network.
• Enterprise Exposure. Extend discovery beyond network addresses to cloud-hosted workloads, SaaS applications, application programming interfaces (APIs), and identities used by automation.
• Vulnerability Assessment. Use scanner findings, service details, reachability, and business function to decide which exposure requires validation and correction.
• Exploit Validation and Host Records. Validate an exposure under controlled conditions and inspect the Windows records created by the resulting access.
• Identity Exposure. Examine challenge-response capture, password reuse, and remote administrative access as separate ways credentials can extend an intrusion.
• Non-Human Identities and AI Agents. Assess service accounts, tokens, integrations, and agent identities that may exist outside routine ownership and access reviews.
• Command and Control. Compare host and network records created by two command-and-control frameworks to determine whether either channel would be detected and scoped.
• Segmentation and Reachability. Assess which systems, services, and management planes an exposed service or credential can reach.
• Configuration Drift and Controlled Automation. Preview one low-impact change, apply it to approved targets, repeat it, and verify the resulting files on each system.

Overview

Response decisions begin while scope is developing. A SaaS audit log, cloud management record, or MSSP-held alert may be required before a responder can identify the affected account or contain a system. The organization must correct any contractual, access, retention, or authority gap that could keep the needed record from responders during the next investigation.

Recovered files and Windows artifacts can narrow the ransomware window or connect activity to a user or system. The defender must document missing execution records and inaccessible provider logs because either gap could affect containment or recovery.

Full Lab Details

• Deleted-File Recovery. Compare what Windows displays with underlying filesystem records, recover deleted content, and determine which claims the recovery method supports about a file's name, location, and prior state.
• Windows Activity and Persistence. Use host artifacts to connect prior activity with a user or system, identify a persistence entry, and determine which execution records remain missing.
• Incident Handoff Review. Check each claim against the artifact it cites, remove excessive claims, and document which statements remain supportable or require additional records.
• Ransomware Timeline. Narrow the infection window, reconstruct the sequence surrounding visible encryption, and document delivery or execution as unresolved when the timeline does not record them.
• Ransomware Network Scope. Compare network and historical DNS records with one affected host to identify systems requiring further examination without treating shared infrastructure as shared compromise.

Full Topic Details

• Response Thresholds and Authority. Decide whether the available records justify an incident declaration, collection from additional systems, containment, or leadership escalation, and identify who has authority to act.
• Artifact Collection and Integrity. Preserve the source and collection details needed to explain where an artifact came from and whether a response action may change it.
• Windows Artifact Interpretation. Use the Red Poster to locate registry, event, filesystem, and cache artifacts tied to earlier user or system activity.
• AI-Assisted Handoffs. Check each claim in a draft handoff against the artifact it cites before the note becomes part of the incident record.
• Incident Scoping. Select network, host, identity, and provider records according to the system or account the response may affect.
• Containment. Match isolation, credential changes, and other response actions to the systems and accounts placed in scope by the available records.
• Eradication and Recovery. Remove identified persistence and compromised access before an affected system or service returns to operation.
• Provider and MSSP Access. Correct contracts, retention periods, access rights, and escalation procedures that keep audit records from responders during an investigation.

Overview

Malware remains central to ransomware, espionage, credential theft, and destructive attacks. Analyzing a specimen can expose behavior that the enterprise failed to record or restrict and provide artifacts for identifying affected systems.

Each analysis stage adds details about the file and its behavior that can change which systems require review and which controls require correction. Enterprise records remain necessary to establish the specimen's role in the wider incident.

Full Lab Details

• Static Properties Analysis. Examine file properties without running the specimen, then determine which identifiers can support immediate triage and which suggested behaviors require later testing.
• Host Behavior Analysis. Observe processes, copied files, registry changes, and persistence created during execution, then use these artifacts to distinguish affected systems from systems that only received the file.
• Network Behavior Analysis. Provide controlled network services and alter a response to identify dependencies, confirm observable requests, and determine which network records can support detection or containment.
• Manual Code Reversing. Review deobfuscated program logic to confirm file selection, encryption, and network behavior left unresolved by earlier analysis, then apply these details to detection and recovery.

Full Topic Details

• Malware in Enterprise Incidents. Connect a suspicious file with the host and network records needed to assess its role in an active investigation.
• Malware Triage. Select an analysis stage according to the question being asked, the time available, and the risk of running the specimen.
• Static Properties Analysis. Inspect hashes, strings, imports, metadata, and packing before the specimen is executed.
• Interactive Host Analysis. Observe processes, copied files, registry changes, persistence, and other activity created during controlled execution.
• Network Behavior Analysis. Examine DNS lookups, web requests, and service responses associated with the running specimen.
• Manual Code Reversing. Review deobfuscated program logic to examine file selection, encryption, network dependencies, and behavior that earlier analysis left unresolved.
• Enterprise Control Changes. Use confirmed malware behavior to improve record collection, test an alert, restrict the activity, and verify that compromised access is removed before recovery.

Overview

The Capture the Flags (CTF) capstone uses independent challenges that range from one precise command or lookup to several artifacts that must be combined before an answer can be submitted. You will work with network services, packet captures, filesystems, hashes, and code as you choose the order of the challenges. Working individually or with a team, you must decide whether the available records support an answer, whether another artifact is required, and when to move to another challenge.