ＨｉｄｅＺｅｒｏＯｎｅ

SEC699 is SANS’s advanced purple team offering, with a key focus on adversary emulation for data breach prevention and detection. Throughout this course, students will learn how real-life threat actors can be emulated in a realistic enterprise environment, including multiple AD forests. In true purple fashion, the goal of the course is to educate students on how adversarial techniques can be emulated (manual and automated) and detected (use cases / rules and anomaly-based detection). A natural follow-up to SEC599, this is an advanced SANS course offering, with 60 percent of class time spent in 29 hands-on labs!

SEC699.1: Introduction & Key Tools
SEC699.2: Initial Intrusion Strategies Emulation & Detection
SEC699.3: Privilege Escalation & Lateral Movement Emulation & Detection
SEC699.4: Persistence Emulation & Detection
SEC699.5: Emulation Plans (Extended Access To CTF Range)

SEC699: Advanced Purple Teaming – Adversary Emulation & Detection Engineering

Defeating Advanced Adversaries – Purple Team Tactics & Kill Chain Defenses will arm you with the knowledge and expertise you need to overcome today’s threats. Recognizing that a prevent-only strategy is not sufficient, we will introduce security controls aimed at stopping, detecting, and responding to your adversaries through a purple team strategy. 20+ Hands-on Labs & a unique APT Defender Capstone

SEC599.1: Introduction and Reconnaissance
SEC599.2: Payload Delivery and Execution
SEC599.3: Exploitation, Persistence, and Command and Control
SEC599.4: Lateral Movement
SEC599.5: Action on Objectives, Threat Hunting, and Incident Response
SEC599.6: APT Defender Capstone

SEC599: Defeating Advanced Adversaries – Purple Team Tactics & Kill Chain Defenses

Develop and improve Red Team operations for security controls in SEC565 through adversary emulation, cyber threat intelligence, Red Team tradecraft, and engagement planning. Learn how to execute consistent and repeatable Red Team engagements that are focused on the effectiveness of the people, processes, and technology used to defend environments.

SEC565.1: Planning Adversary Emulation and Threat Intelligence
SEC565.2: Attack Infrastructure and Operational Security
SEC565.3: Getting In and Staying In
SEC565.4: Active Directory Attacks and Lateral Movement
SEC565.5: Obtaining the Objective and Reporting
SEC565.6: Immersive Red Team Capture-the-Flag

SEC565: Red Team Operations and Adversary Emulation

Many organizations have logging capabilities but lack the people and processes to analyze them. In addition, logging systems collect vast amounts of data from a variety of data sources which require an understanding of the sources for proper analysis. This class is designed to provide training, methods, and processes for enhancing existing logging solutions. This class will also provide the understanding of the when, what, and why behind the logs. This is a lab-heavy course that utilizes SOF-ELK, a SANS-sponsored free SIEM solution, to train hands-on experience and provide the mindset for large-scale data analysis.

SEC555.1: SIEM Architecture
SEC555.2: Service Profiling with SIEM
SEC555.3: Advanced Endpoint Analytics
SEC555.4: Baselining and User Behavior Monitoring
SEC555.5: Tactical SIEM Detection and Post-Mortem Analysis
SEC555.6: Capstone: Design, Detect, Defend

SEC555: SIEM with Tactical Analytics

The age of cloud computing has arrived as organizations have seen the advantages of migrating their applications from traditional on-premises networks. However, the rapid adoption of cloud has left the cloud security architect scrambling to design on this new medium. A shift to the cloud requires cybersecurity professionals to reorient their security goals around a new threat model to enable business requirements while improving their organization’s security posture. This enterprise cloud security architecture training course will teach students to create secure identity and network patterns in the cloud in order to support business at any stage of the cloud journey, whether planning for first workloads, managing complex legacy environments, or operating in an advanced cloud-native ecosystem. 20 Hands-On Labs

SEC542 empowers students to quickly evaluate and expose security vulnerabilities in web applications, showcasing the potential business repercussions of exploitation. Gain practical experience in exploiting web apps within your enterprise, mastering attackers’ tools and methods. Through hands-on exercises you will learn a best practice process for web application penetration testing, inject SQL into back-end databases to learn how attackers exfiltrate sensitive data, and utilize cross-site scripting attacks to dominate a target infrastructure. 30+ Hands-on Labs

SEC542.1: Introduction and Information Gathering
SEC542.2: Fuzzing, Scanning, Authentication, and Session Testing
SEC542.3: Injection
SEC542.4: XSS, SSRF, and XXE
SEC542.5: CSRF, Logic Flaws and Advanced Tools
SEC542.6: Capture the Flag

SEC542: Web App Penetration Testing and Ethical Hacking