ＨｉｄｅＺｅｒｏＯｎｅ

SEC699 is SANS’s advanced purple team offering, with a key focus on adversary emulation for data breach prevention and detection. Throughout this course, students will learn how real-life threat actors can be emulated in a realistic enterprise environment, including multiple AD forests. In true purple fashion, the goal of the course is to educate students on how adversarial techniques can be emulated (manual and automated) and detected (use cases / rules and anomaly-based detection). A natural follow-up to SEC599, this is an advanced SANS course offering, with 60 percent of class time spent in 29 hands-on labs!

SEC699.1: Introduction & Key Tools
SEC699.2: Initial Intrusion Strategies Emulation & Detection
SEC699.3: Privilege Escalation & Lateral Movement Emulation & Detection
SEC699.4: Persistence Emulation & Detection
SEC699.5: Emulation Plans (Extended Access To CTF Range)

SEC699: Advanced Purple Teaming – Adversary Emulation & Detection Engineering

Defeating Advanced Adversaries – Purple Team Tactics & Kill Chain Defenses will arm you with the knowledge and expertise you need to overcome today’s threats. Recognizing that a prevent-only strategy is not sufficient, we will introduce security controls aimed at stopping, detecting, and responding to your adversaries through a purple team strategy. 20+ Hands-on Labs & a unique APT Defender Capstone

SEC599.1: Introduction and Reconnaissance
SEC599.2: Payload Delivery and Execution
SEC599.3: Exploitation, Persistence, and Command and Control
SEC599.4: Lateral Movement
SEC599.5: Action on Objectives, Threat Hunting, and Incident Response
SEC599.6: APT Defender Capstone

SEC599: Defeating Advanced Adversaries – Purple Team Tactics & Kill Chain Defenses

Develop and improve Red Team operations for security controls in SEC565 through adversary emulation, cyber threat intelligence, Red Team tradecraft, and engagement planning. Learn how to execute consistent and repeatable Red Team engagements that are focused on the effectiveness of the people, processes, and technology used to defend environments.

SEC565.1: Planning Adversary Emulation and Threat Intelligence
SEC565.2: Attack Infrastructure and Operational Security
SEC565.3: Getting In and Staying In
SEC565.4: Active Directory Attacks and Lateral Movement
SEC565.5: Obtaining the Objective and Reporting
SEC565.6: Immersive Red Team Capture-the-Flag

SEC565: Red Team Operations and Adversary Emulation

Many organizations have logging capabilities but lack the people and processes to analyze them. In addition, logging systems collect vast amounts of data from a variety of data sources which require an understanding of the sources for proper analysis. This class is designed to provide training, methods, and processes for enhancing existing logging solutions. This class will also provide the understanding of the when, what, and why behind the logs. This is a lab-heavy course that utilizes SOF-ELK, a SANS-sponsored free SIEM solution, to train hands-on experience and provide the mindset for large-scale data analysis.

SEC555.1: SIEM Architecture
SEC555.2: Service Profiling with SIEM
SEC555.3: Advanced Endpoint Analytics
SEC555.4: Baselining and User Behavior Monitoring
SEC555.5: Tactical SIEM Detection and Post-Mortem Analysis
SEC555.6: Capstone: Design, Detect, Defend

SEC555: SIEM with Tactical Analytics

The age of cloud computing has arrived as organizations have seen the advantages of migrating their applications from traditional on-premises networks. However, the rapid adoption of cloud has left the cloud security architect scrambling to design on this new medium. A shift to the cloud requires cybersecurity professionals to reorient their security goals around a new threat model to enable business requirements while improving their organization’s security posture. This enterprise cloud security architecture training course will teach students to create secure identity and network patterns in the cloud in order to support business at any stage of the cloud journey, whether planning for first workloads, managing complex legacy environments, or operating in an advanced cloud-native ecosystem. 20 Hands-On Labs

Organizations are moving to the cloud to enable digital transformation and reap the benefits of cloud computing. However, security teams struggle to understand the DevOps toolchain and how to introduce security controls in their automated pipelines responsible for delivering changes to cloud-based systems. Without effective pipeline security controls, security teams lose visibility into the changes released into production environments. SEC540 provides security professionals with the knowledge they need to automate guardrails and security policies in their organization’s DevOps pipelines, cloud infrastructure, container orchestrators, and microservice environments. By embracing the DevOps culture, students will walk away from SEC540 battle-tested and ready to build to their organization’s Cloud & DevSecOps Security Program. 35 Unique, Immersive, Hands-On Labs + CloudWars Bonus Challenges

SEC540.1: DevOps Security Automation
SEC540.2: Cloud Infrastructure Security
SEC540.3: Cloud Native Security Operations
SEC540.4: Microservice and Serverless Security
SEC540.5: Continuous Compliance and Protection

SEC540: Cloud Security and DevSecOps Automation