Use advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
Focused challenges designed to test judgment, evidence handling and defensible security decisions.
Free, independent knowledge assessments. Review the scope, preparation and scoring before you begin. Suggested times are study guidance; passing can earn a Threat Intelligence Lab platform certificate, not an accredited or third-party vendor qualification.
Start with a course check, a source-based investigation or a specialist topic.
Choose a focused assessment aligned with practical course material, from security awareness and cloud security to incident response and software supply chains.
8 assessments Work from sources Investigate real threat reportingUse advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
62 assessments Think like an analyst Test your intelligence tradecraftAssess requirements, evidence evaluation, analysis, structured intelligence, actor profiling and decision-focused communication.
17 assessments Detect and respond Practice operational security decisionsChallenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
22 assessments Protect modern systems Assess trust across connected systemsTest cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
28 assessments Follow the operation Trace malicious behavior and infrastructureAnalyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
53 assessmentsInvestigate Akira's evolving hypervisor targeting, identity tradecraft, defense evasion, and virtual-disk credential theft using the official joint advisory.
Review assessment : AA24-109A Akira Hypervisor and Credential-Theft InvestigationTrace Black Basta's email-bombing support scam, RMM deployment, ConnectWise exploitation, masqueraded discovery, EDR disabling, exfiltration, and cryptographic impact.
Review assessment : AA24-131A Black Basta Social-Engineering and Encryption ResearchCompare two APT40 incident-response case studies involving a custom web application, service-account compromise, Secure Socket Funnelling, remote-access appliances, MFA artifacts, and session tokens.
Review assessment : AA24-190A APT40 Case-Study Evidence ResearchUse the SILENTSHIELD report to analyze parallel access paths, long dwell time, diversified implants, timestamp tampering, Sysmon visibility, and organizational response failures.
Review assessment : AA24-193A SILENTSHIELD Detection-Evasion InvestigationInvestigate the DPRK RGB 3rd Bureau's defense collection requirements, ransomware funding, web-server exploitation, custom RAT inventory, command habits, and packed tooling.
Review assessment : AA24-207A Andariel Espionage and Malware ResearchInvestigate how an Iran-linked group turns edge-device exploitation into credential capture, durable access, ransomware partnerships, and separate state-aligned collection.
Review assessment : AA24-241A Iran-Based Access-Broker Tradecraft InvestigationResearch RansomHub's affiliate model, exploit set, exfiltration separation, Curve25519 encryption, intermittent block processing, and encrypted-file trailer structure.
Review assessment : AA24-242A RansomHub Encryption-Format InvestigationResearch Unit 29155's scanning, vulnerability exploitation, IP-camera access, tunneling, post-exploitation tools, and destructive mission using the joint advisory.
Review assessment : AA24-249A GRU Unit 29155 Infrastructure InvestigationTrace an Iranian access operation from password spraying and MFA registration through Kerberos discovery, living-off-the-land reconnaissance, and probable resale of network access.
Review assessment : AA24-290A Iranian Credential-Access InvestigationUse the multinational report to compare zero-day prevalence, exploitation windows, affected products, weakness classes, and exploit consequences among 2023's top vulnerabilities.
Review assessment : AA24-317A 2023 Exploited-Vulnerability Evidence ResearchReconstruct how a CISA red team moved from a forgotten webshell through Linux credential stores and Kerberos delegation to domain compromise, then evaluate the defender response.
Review assessment : AA24-326A Critical-Infrastructure Red-Team ReconstructionTrace two Ivanti Cloud Service Appliance exploit chains from access-control bypass through credential theft, command execution, webshell attempts, and lateral movement.
Review assessment : AA25-022A Ivanti CSA Exploit-Chain InvestigationInvestigate Ghost's opportunistic exploitation, short dwell time, Cobalt Strike execution, encoded lateral movement, limited exfiltration, and recovery inhibition.
Review assessment : AA25-050A Ghost Ransomware Intrusion ResearchResearch Medusa's broker model, discovery ports, PowerShell evasion, lateral movement, encryption artifacts, and extortion process from documented investigations.
Review assessment : AA25-071A Medusa Ransomware Operations InvestigationResearch fast-flux infrastructure as a CTI collection problem, distinguish single from double flux, and evaluate DNS evidence without misclassifying legitimate CDNs.
Review assessment : AA25-093A Fast-Flux DNS Infrastructure Investigation