Analyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
Focused challenges designed to test judgment, evidence handling and defensible security decisions.
Pick a focused route instead of searching through internal categories and advisory tags.
Choose a focused assessment aligned with practical course material, from security awareness and cloud security to incident response and software supply chains.
8 assessments Work from sources Investigate real threat reportingUse advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
62 assessments Think like an analyst Test your intelligence tradecraftAssess requirements, evidence evaluation, analysis, structured intelligence, actor profiling and decision-focused communication.
17 assessments Detect and respond Practice operational security decisionsChallenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
21 assessments Protect modern systems Assess trust across connected systemsTest cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
27 assessments Follow the operation Trace malicious behavior and infrastructureAnalyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
53 assessmentsAssess incident-response judgment across preparation, triage, evidence, scoping, containment, communication, recovery, identity compromise, cloud control incidents, and ransomware.
Review Incident Response Foundations: Evidence-Led Decisions ExamThis certification exam validates your understanding of infostealers—what they are, how they operate, how they exfiltrate data, and how to defend against them. It covers the full scope of the Infostealers course.
Review Infostealers Certification ExamAn advanced professional exam testing knowledge of systemic ransomware recovery, Minimum Viable Factory Recovery (MVF), and critical-infrastructure cyber resilience based on real-world incidents and academic frameworks.
Review Systemic Ransomware Recovery and Cyber ResilienceThis exam assesses knowledge of the ShinyHunters hacking group, a prolific cybercriminal collective known for large-scale data breaches, extortion, and data sales on underground forums. The exam covers their key victims (2020-2025), operational tactics, infrastructure, affiliations, and law enforcement countermeasures.
Review The ShinyHunters Cybercrime Collective: Operations, Techniques, and ImpactAn expanded case-based assessment of TDS mechanics, named services and campaigns, networks, bulletproof hosting, evidence, detection, and disruption.
Review Traffic Distribution Systems in Cybercrime ExamTest your ability to analyze phishing and social-engineering campaigns through lure themes, delivery chains, sender infrastructure, credential capture, payload staging, audience targeting, campaign clustering, and defensive intelligence.
Review CTI Phishing Campaigns & Social Engineering AnalysisTest your ability to analyze ransomware ecosystems, distinguish operator and affiliate roles, interpret leak sites and negotiations, assess initial access, track rebrands, and produce decision-relevant extortion intelligence.
Review CTI Ransomware Ecosystems & Extortion OperationsTest your ability to analyze malware-related intelligence, distinguish families from samples, connect technical evidence to campaigns, evaluate behavioral and code similarities, interpret configuration and infrastructure relationships, track campaign evolution, and communicate confidence without overstating attribution in Cyber Threat Intelligence.
Review CTI Malware Analysis & Campaign TrackingTest your ability to analyze adversary infrastructure, interpret passive DNS and historical registration data, assess infrastructure overlap, account for shared hosting and temporal context, validate investigative pivots, evaluate clustering confidence, and avoid unsupported attribution in Cyber Threat Intelligence.
Review CTI Adversary Infrastructure & PivotingUse the CISA and U.S. Coast Guard hunt report to decide which observed configuration and logging gaps would prevent defensible incident analysis in an IT/OT environment.
Review AA25-212A Critical-Infrastructure Hunt Gap AnalysisResearch how APT28 used weak SNMP configuration and a known Cisco vulnerability to enumerate routers, deploy Jaguar Tooth, collect network data, and maintain covert access.
Review AA23-108 APT28 Router Exploitation AnalysisExamine the Snake implant's Windows persistence, encrypted artifacts, Queue structure, modular protocol stack, layered encryption, and global peer-to-peer relay design.
Review AA23-129A Snake Implant ArchitectureResearch BianLian's access, proxying, privilege escalation, discovery, credential theft, defense evasion, and changing extortion model from the joint advisory.
Review AA23-136A BianLian Intrusion TradecraftInvestigate CL0P's MOVEit Transfer campaign by connecting the exploited SQL injection to LEMURLOOT authentication, database access, privileged-account behavior, and data theft.
Review AA23-158A MOVEit LEMURLOOT ResearchTrace Truebot from delivery and environment checks through FlawedGrace execution, in-memory follow-on activity, encoded collection, and Teleport exfiltration.
Review AA23-187A Truebot Toolchain Investigation
