Analyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
Focused challenges designed to test judgment, evidence handling and defensible security decisions.
Pick a focused route instead of searching through internal categories and advisory tags.
Choose a focused assessment aligned with practical course material, from security awareness and cloud security to incident response and software supply chains.
8 assessments Work from sources Investigate real threat reportingUse advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
62 assessments Think like an analyst Test your intelligence tradecraftAssess requirements, evidence evaluation, analysis, structured intelligence, actor profiling and decision-focused communication.
17 assessments Detect and respond Practice operational security decisionsChallenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
21 assessments Protect modern systems Assess trust across connected systemsTest cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
27 assessments Follow the operation Trace malicious behavior and infrastructureAnalyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
53 assessmentsAnalyze appliance-side webshell, privilege, staging, persistence, and anti-forensic artifacts from exploitation of Citrix NetScaler ADC and Gateway systems.
Review AA23-201A Citrix NetScaler Artifact AnalysisInvestigate a vulnerability chain against Ivanti EPMM and use API, log, user-agent, certificate, and webshell evidence to design defensible hunting conclusions.
Review AA23-213A Ivanti EPMM Forensic HuntingResearch QakBot's evolution, tiered command-and-control design, registry persistence, and the operational limits of the 2023 disruption.
Review AA23-242A QakBot Infrastructure ResearchReconstruct two nation-state intrusion paths at an aeronautical organization and connect account, malware, credential, and network evidence to the correct phase of the investigation.
Review AA23-250A Aeronautical Intrusion Timeline AnalysisInvestigate Snatch's RDP entry, bulletproof-hosted command-and-control, long dwell time, service manipulation, Safe Mode boot, shadow-copy removal, filename masquerading, and recovery note.
Review AA23-263A Snatch Safe-Mode Encryption and Dwell-Time AnalysisAnalyze BlackTech's subsidiary-to-headquarters pivots, router firmware replacement, ROMMON bypass, unlogged SSH backdoors, EEM output manipulation, and magic-packet activation.
Review AA23-270A BlackTech Router Firmware and Trusted-Pivot InvestigationClassify AvosLocker remote administration, tunneling, credential theft, exfiltration, scripting, web-shell persistence, and the NetMonitor reverse-proxy behavior captured by the FBI YARA rule.
Review AA23-284A AvosLocker Dual-Use Tool and NetMonitor Detection AnalysisInvestigate Rhysida's valid-account access, MFT evidence, Windows staging, remote execution, Azure storage utilities, process injection, cryptographic design, and ransom-note artifact.
Review AA23-319A Rhysida Staging, Cloud Transfer, and Encryptor ResearchTrace Scattered Spider from helpdesk impersonation and MFA transfer through legitimate remote tools, credential stealers, AWS discovery, Snowflake collection, response monitoring, and ESXi impact.
Review AA23-320A Scattered Spider Helpdesk-to-Cloud Intrusion AnalysisInvestigate how LockBit affiliates extracted NetScaler session material, bypassed MFA, staged an encoded DLL, required a launch key, and established command-and-control.
Review AA23-325A Citrix Bleed Session-Theft and LockBit Payload AnalysisReconstruct two ColdFusion compromises from vulnerable versions and exploit paths through web-shell decoding, credential artifacts, network reconnaissance, and failed exfiltration.
Review AA23-339A ColdFusion Web-Shell and Registry-Dump InvestigationExamine SVR exploitation of TeamCity, software-build risk, EDRSandBlast defense evasion, GraphicalProton's cloud covert channel, registry collection, and server-log evidence.
Review AA23-347A SVR TeamCity Supply-Chain Foothold InvestigationCompare Play's Windows and ESXi operations, initial-access CVEs, custom discovery tooling, Group Policy distribution, intermittent encryption, and campaign-specific recompilation.
Review AA23-352A Play Ransomware Windows-to-ESXi Technical HuntAnalyze ALPHV Blackcat's social engineering, remote tooling, adversary-in-the-middle credential theft, Kerberos access, defense evasion, exfiltration, and encryptor artifacts.
Review AA23-353A ALPHV Blackcat Access and Affiliate Tooling ResearchInvestigate how Androxgh0st finds exposed application secrets, chains PHPUnit and Laravel weaknesses, exploits Apache path traversal, and repurposes stolen cloud credentials.
Review AA24-016A Androxgh0st Web Exposure and Cloud-Credential Hunt
