Analyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
Focused challenges designed to test judgment, evidence handling and defensible security decisions.
Free, independent knowledge assessments. Review the scope, preparation and scoring before you begin. Suggested times are study guidance; passing can earn a Threat Intelligence Lab platform certificate, not an accredited or third-party vendor qualification.
Start with a course check, a source-based investigation or a specialist topic.
Choose a focused assessment aligned with practical course material, from security awareness and cloud security to incident response and software supply chains.
8 assessments Work from sources Investigate real threat reportingUse advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
62 assessments Think like an analyst Test your intelligence tradecraftAssess requirements, evidence evaluation, analysis, structured intelligence, actor profiling and decision-focused communication.
17 assessments Detect and respond Practice operational security decisionsChallenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
22 assessments Protect modern systems Assess trust across connected systemsTest cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
28 assessments Follow the operation Trace malicious behavior and infrastructureAnalyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
53 assessmentsAssess incident-response judgment across preparation, triage, evidence, scoping, containment, communication, recovery, identity compromise, cloud control incidents, and ransomware.
Review assessment : Incident Response Foundations: Evidence-Led Decisions ExamAssess your understanding of infostealer behavior, data theft and defensive concepts in this independent malware knowledge check.
Review assessment : Infostealers Certification ExamAn advanced professional exam testing knowledge of systemic ransomware recovery, Minimum Viable Factory Recovery (MVF), and critical-infrastructure cyber resilience based on real-world incidents and academic frameworks.
Review assessment : Systemic Ransomware Recovery and Cyber ResilienceThis exam assesses knowledge of the ShinyHunters hacking group, a prolific cybercriminal collective known for large-scale data breaches, extortion, and data sales on underground forums. The exam covers their key victims (2020-2025), operational tactics, infrastructure, affiliations, and law enforcement countermeasures.
Review assessment : The ShinyHunters Cybercrime Collective: Operations, Techniques, and ImpactAn expanded case-based assessment of TDS mechanics, named services and campaigns, networks, bulletproof hosting, evidence, detection, and disruption.
Review assessment : Traffic Distribution Systems in Cybercrime ExamTest your ability to analyze phishing and social-engineering campaigns through lure themes, delivery chains, sender infrastructure, credential capture, payload staging, audience targeting, campaign clustering, and defensive intelligence.
Review assessment : CTI Phishing Campaigns & Social Engineering AnalysisTest your ability to analyze ransomware ecosystems, distinguish operator and affiliate roles, interpret leak sites and negotiations, assess initial access, track rebrands, and produce decision-relevant extortion intelligence.
Review assessment : CTI Ransomware Ecosystems & Extortion OperationsTest your ability to analyze malware-related intelligence, distinguish families from samples, connect technical evidence to campaigns, evaluate behavioral and code similarities, interpret configuration and infrastructure relationships, track campaign evolution, and communicate confidence without overstating attribution in Cyber Threat Intelligence.
Review assessment : CTI Malware Analysis & Campaign TrackingTest your ability to analyze adversary infrastructure, interpret passive DNS and historical registration data, assess infrastructure overlap, account for shared hosting and temporal context, validate investigative pivots, evaluate clustering confidence, and avoid unsupported attribution in Cyber Threat Intelligence.
Review assessment : CTI Adversary Infrastructure & PivotingUse the CISA and U.S. Coast Guard hunt report to decide which observed configuration and logging gaps would prevent defensible incident analysis in an IT/OT environment.
Review assessment : AA25-212A Critical-Infrastructure Hunt Gap AnalysisResearch how APT28 used weak SNMP configuration and a known Cisco vulnerability to enumerate routers, deploy Jaguar Tooth, collect network data, and maintain covert access.
Review assessment : AA23-108 APT28 Router Exploitation AnalysisExamine the Snake implant's Windows persistence, encrypted artifacts, Queue structure, modular protocol stack, layered encryption, and global peer-to-peer relay design.
Review assessment : AA23-129A Snake Implant ArchitectureResearch BianLian's access, proxying, privilege escalation, discovery, credential theft, defense evasion, and changing extortion model from the joint advisory.
Review assessment : AA23-136A BianLian Intrusion TradecraftInvestigate CL0P's MOVEit Transfer campaign by connecting the exploited SQL injection to LEMURLOOT authentication, database access, privileged-account behavior, and data theft.
Review assessment : AA23-158A MOVEit LEMURLOOT ResearchTrace Truebot from delivery and environment checks through FlawedGrace execution, in-memory follow-on activity, encoded collection, and Teleport exfiltration.
Review assessment : AA23-187A Truebot Toolchain Investigation