Use advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
Focused challenges designed to test judgment, evidence handling and defensible security decisions.
Pick a focused route instead of searching through internal categories and advisory tags.
Choose a focused assessment aligned with practical course material, from security awareness and cloud security to incident response and software supply chains.
8 assessments Work from sources Investigate real threat reportingUse advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
62 assessments Think like an analyst Test your intelligence tradecraftAssess requirements, evidence evaluation, analysis, structured intelligence, actor profiling and decision-focused communication.
17 assessments Detect and respond Practice operational security decisionsChallenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
21 assessments Protect modern systems Assess trust across connected systemsTest cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
27 assessments Follow the operation Trace malicious behavior and infrastructureAnalyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
53 assessmentsAnalyze LummaC2's delivery, host checks, command configuration, browser theft, download execution, and memory-resident behavior using the FBI and CISA report.
Review AA25-141B LummaC2 Configuration and Execution ResearchTrace GRU Unit 26165's credential attacks, vulnerability use, Active Directory collection, logistics intelligence requirements, and IP-camera reconnaissance.
Review AA25-141A GRU Logistics and Camera Targeting InvestigationInvestigate how an unpatched remote-management component exposed a software provider's downstream customers and determine the correct discovery and response steps.
Review AA25-163A SimpleHelp Downstream-Exposure InvestigationReconstruct Interlock's unusual initial access, persistence, credential theft, Azure exfiltration, and virtual-machine encryption from the joint advisory.
Review AA25-203A Interlock Ransomware Attack-Chain ResearchInvestigate the joint government report on PRC-linked compromises of telecommunications and edge infrastructure, then distinguish vulnerable-device activity from normal router behavior.
Review AA25-239A Network-Device Espionage InvestigationResearch official YARA rule syntax to interpret string types, modifiers, hex wildcards and jumps, Boolean conditions, occurrence counts, identifiers, and output behavior for malware-focused collection.
Review YARA Rule Technical InvestigationResearch Sigma's official rule format to interpret log sources, detection selections, conditions, field modifiers, status, severity, false positives, and portable rule intent.
Review Sigma Detection Rule Technical InvestigationResearch IETF RDAP JSON to interpret domain, network, autonomous-system, entity, event, status, notice, remark, and extension data without overclaiming what registration records prove.
Review RDAP Registration Data Technical InvestigationResearch Kubernetes auditing to identify event stages, select policy levels, understand first-match evaluation, configure the API server, and balance investigative detail with sensitive-data exposure.
Review Kubernetes Audit Policy Technical InvestigationUse Microsoft Defender XDR's official advanced-hunting schema to select event tables, interpret process and network fields, correlate unique events, and retrieve trustworthy signing evidence.
Review Microsoft Defender XDR Hunting Schema InvestigationResearch CISA joint advisory AA24-038A to extract exact living-off-the-land commands, artifacts, ATT&CK mappings, persistence observations, and investigative implications from reported victim evidence.
Review CISA Joint Advisory Evidence Hunt: Volt TyphoonExtract vulnerability, product, impact, weakness, scoring, and affected-version evidence from a specific CISA industrial control systems advisory without substituting assumptions about operational exposure.
Review CISA ICS Advisory Technical InvestigationResearch the OASIS TAXII 2.1 standard to discover servers, interpret API roots and collection permissions, retrieve manifests, filter STIX objects, and handle protocol pagination correctly.
Review TAXII 2.1 API Technical InvestigationResearch the OASIS STIX 2.1 specification to model indicators, observed data, relationships, sightings, bundles, and object properties without confusing transport containers with intelligence assertions.
Review STIX 2.1 Object Modeling InvestigationNavigate FIRST's CVSS v4 specification and data representations to interpret metric groups, vector nomenclature, impact separation, and the role of supplemental context.
Review CVSS v4 Vector Technical Research
