Use advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
Focused challenges designed to test judgment, evidence handling and defensible security decisions.
Pick a focused route instead of searching through internal categories and advisory tags.
Choose a focused assessment aligned with practical course material, from security awareness and cloud security to incident response and software supply chains.
8 assessments Work from sources Investigate real threat reportingUse advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
62 assessments Think like an analyst Test your intelligence tradecraftAssess requirements, evidence evaluation, analysis, structured intelligence, actor profiling and decision-focused communication.
17 assessments Detect and respond Practice operational security decisionsChallenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
21 assessments Protect modern systems Assess trust across connected systemsTest cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
27 assessments Follow the operation Trace malicious behavior and infrastructureAnalyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
53 assessmentsInvestigate exploitation of Confluence setup state, unauthorized administrator creation, Rclone configuration, observed user agents, product scope, and post-compromise recovery decisions.
Review AA23-289A Confluence Administrator-Creation and Exfiltration HuntInvestigate Rhysida's valid-account access, MFT evidence, Windows staging, remote execution, Azure storage utilities, process injection, cryptographic design, and ransom-note artifact.
Review AA23-319A Rhysida Staging, Cloud Transfer, and Encryptor ResearchTrace Scattered Spider from helpdesk impersonation and MFA transfer through legitimate remote tools, credential stealers, AWS discovery, Snowflake collection, response monitoring, and ESXi impact.
Review AA23-320A Scattered Spider Helpdesk-to-Cloud Intrusion AnalysisInvestigate how LockBit affiliates extracted NetScaler session material, bypassed MFA, staged an encoded DLL, required a launch key, and established command-and-control.
Review AA23-325A Citrix Bleed Session-Theft and LockBit Payload AnalysisAnalyze IRGC-affiliated compromise of Unitronics PLCs, including exposed engineering access, ladder-logic replacement, device renaming, version rollback, port changes, and HMI defacement.
Review AA23-335A CyberAv3ngers Unitronics PLC Impact ReconstructionReconstruct two ColdFusion compromises from vulnerable versions and exploit paths through web-shell decoding, credential artifacts, network reconnaissance, and failed exfiltration.
Review AA23-339A ColdFusion Web-Shell and Registry-Dump InvestigationTrace Star Blizzard from open-source persona research and rapport building through Evilginx session theft, personal-email targeting, mailbox collection, and follow-on phishing.
Review AA23-341A Star Blizzard Persona-to-Session Spearphishing AnalysisExamine SVR exploitation of TeamCity, software-build risk, EDRSandBlast defense evasion, GraphicalProton's cloud covert channel, registry collection, and server-log evidence.
Review AA23-347A SVR TeamCity Supply-Chain Foothold InvestigationCompare Play's Windows and ESXi operations, initial-access CVEs, custom discovery tooling, Group Policy distribution, intermittent encryption, and campaign-specific recompilation.
Review AA23-352A Play Ransomware Windows-to-ESXi Technical HuntAnalyze ALPHV Blackcat's social engineering, remote tooling, adversary-in-the-middle credential theft, Kerberos access, defense evasion, exfiltration, and encryptor artifacts.
Review AA23-353A ALPHV Blackcat Access and Affiliate Tooling ResearchInvestigate how Androxgh0st finds exposed application secrets, chains PHPUnit and Laravel weaknesses, exploits Apache path traversal, and repurposes stolen cloud credentials.
Review AA24-016A Androxgh0st Web Exposure and Cloud-Credential HuntReconstruct a state-government intrusion from a retained former-employee account through SharePoint credential exposure, LDAP discovery, CIFS access, and cloud scoping.
Review AA24-046A Former-Employee Account and LDAP Evidence InvestigationAssess how SVR operators target service and dormant accounts, reuse tokens, manipulate MFA enrollment, and hide authentication behind residential proxies.
Review AA24-057A SVR Cloud Identity and Session-Persistence AnalysisTrace a Phobos intrusion from exposed RDP and loader behavior through firewall changes, credential access, exfiltration, recovery inhibition, and ransom-note execution.
Review AA24-060A Phobos Intrusion Command and Exfiltration ResearchEvaluate an Ivanti Connect Secure intrusion where web shells, credential exposure, root persistence, and anti-forensic activity challenged normal appliance validation.
Review AA24-060B Ivanti Appliance Forensics and Integrity-Check Assessment
