In-Depth Investigation & Threat Hunting_

Overview

With the rise of APT attacks and targeted ransomware, organizations need people who can investigate deeply and hunt for threats proactively. Every day an intrusion goes undetected, the cost of the breach climbs. The goal of this training is simple: catch these attacks early, before they become a crisis.

You will learn how to perform in-depth investigations by collecting key artifacts, running live forensics and memory forensics, and automating analysis across the enterprise. On top of that, you will build a threat hunting process grounded in the MITRE ATT&CK framework and current threat intelligence, so your hunts are driven by how real attackers actually operate.

The training is built around purple team exercises. In a cloud-based lab running HELK, Atomic Red Team, and Caldera, you will simulate APT attacks, fileless malware, and ransomware, then hunt them down using Sysmon, Splunk, Wireshark, Zeek, Volatility, and KAPE. You will write your own Sigma and YARA rules and turn what you find into detections and response playbooks.

By the end of the four days, you will know how to follow an attacker from the first phishing email all the way to credential theft and lateral movement, and how to spot each step along the way.

What you will learn

Day 1 builds your purple team cloud lab and teaches you to think like both attacker and defender. You will deploy HELK, Atomic Red Team, and Caldera in AWS, then immediately use them, simulating spear-phishing attacks and analyzing the logs in Sysmon and Splunk. You will write your first Sigma detection rules before the day ends.

Day 2 moves to the network layer and malware analysis. You will hunt for exfiltration in packet captures with Wireshark and Zeek, analyze different types of malware, write YARA rules, and detect advanced persistence techniques including DLL injection and malware-as-a-DLL.

Day 3 is about the techniques that most analysts struggle with: defense evasion and memory forensics. You will detect process injection, HTML smuggling, and EDR evasion techniques, then learn to capture memory and use the Volatility framework to find injected code, hidden DLLs, and artifacts that disk forensics would miss. You will also run forensic triage with KAPE and analyze MFT structures.

Day 4 covers enterprise-scale investigation and lateral movement detection. You will use PowerShell Remoting and Kansa to collect and triage artifacts across many machines, detect credential theft techniques (LSASS dumps, token impersonation), and hunt for lateral movement: Pass-the-Hash, Golden Ticket, and Kerberos attacks.

How the training is structured

Every detection and every hunt starts with the attack. You will simulate the technique with real tools in your cloud lab, see what artifacts it produces, and then build the hunt or detection for it. This purple team approach means you understand both sides of every technique: what the attacker does and what you should look for.

The lab environment stays accessible for three weeks after the training, so you can continue practicing with the detection rules and playbooks you build during the four days.