Analyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
Focused challenges designed to test judgment, evidence handling and defensible security decisions.
Free, independent knowledge assessments. Review the scope, preparation and scoring before you begin. Suggested times are study guidance; passing can earn a Threat Intelligence Lab platform certificate, not an accredited or third-party vendor qualification.
Start with a course check, a source-based investigation or a specialist topic.
Choose a focused assessment aligned with practical course material, from security awareness and cloud security to incident response and software supply chains.
8 assessments Work from sources Investigate real threat reportingUse advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
62 assessments Think like an analyst Test your intelligence tradecraftAssess requirements, evidence evaluation, analysis, structured intelligence, actor profiling and decision-focused communication.
17 assessments Detect and respond Practice operational security decisionsChallenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
22 assessments Protect modern systems Assess trust across connected systemsTest cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
28 assessments Follow the operation Trace malicious behavior and infrastructureAnalyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
53 assessmentsAnalyze LummaC2's delivery, host checks, command configuration, browser theft, download execution, and memory-resident behavior using the FBI and CISA report.
Review assessment : AA25-141B LummaC2 Configuration and Execution ResearchReconstruct Interlock's unusual initial access, persistence, credential theft, Azure exfiltration, and virtual-machine encryption from the joint advisory.
Review assessment : AA25-203A Interlock Ransomware Attack-Chain ResearchInvestigate the joint government report on PRC-linked compromises of telecommunications and edge infrastructure, then distinguish vulnerable-device activity from normal router behavior.
Review assessment : AA25-239A Network-Device Espionage InvestigationResearch official YARA rule syntax to interpret string types, modifiers, hex wildcards and jumps, Boolean conditions, occurrence counts, identifiers, and output behavior for malware-focused collection.
Review assessment : YARA Rule Technical InvestigationResearch IETF Certificate Transparency v2 to interpret signed certificate timestamps, tree heads, inclusion and consistency proofs, monitor behavior, and the evidentiary limits of public certificate logs.
Review assessment : Certificate Transparency RFC InvestigationResearch IETF RDAP JSON to interpret domain, network, autonomous-system, entity, event, status, notice, remark, and extension data without overclaiming what registration records prove.
Review assessment : RDAP Registration Data Technical InvestigationResearch CISA joint advisory AA24-038A to extract exact living-off-the-land commands, artifacts, ATT&CK mappings, persistence observations, and investigative implications from reported victim evidence.
Review assessment : CISA Joint Advisory Evidence Hunt: Volt TyphoonInvestigate a live ATT&CK group record to connect aliases, techniques, procedure evidence, software, commands, vulnerabilities, and infrastructure into a sourced actor profile.
Review assessment : MITRE ATT&CK Group and Software Investigation