Choose from practical cybersecurity exams covering threat intelligence, incident response, cloud security, malware analysis and defensive research.
Focused challenges designed to test judgment, evidence handling and defensible security decisions.
Free, independent knowledge assessments. Review the scope, preparation and scoring before you begin. Suggested times are study guidance; passing can earn a Threat Intelligence Lab platform certificate, not an accredited or third-party vendor qualification.
Start with a course check, a source-based investigation or a specialist topic.
Choose a focused assessment aligned with practical course material, from security awareness and cloud security to incident response and software supply chains.
8 assessments Work from sources Investigate real threat reportingUse advisories, standards and technical documentation to answer evidence-led questions without overstating what the sources prove.
62 assessments Think like an analyst Test your intelligence tradecraftAssess requirements, evidence evaluation, analysis, structured intelligence, actor profiling and decision-focused communication.
17 assessments Detect and respond Practice operational security decisionsChallenge your judgment across threat hunting, alert triage, detection engineering, incident reconstruction, forensics and recovery.
22 assessments Protect modern systems Assess trust across connected systemsTest cloud evidence, identity threats, third-party exposure, software dependencies and trusted-release decisions.
28 assessments Follow the operation Trace malicious behavior and infrastructureAnalyze malware behavior, ransomware operations, command infrastructure, delivery chains and defensible investigative pivots.
53 assessmentsUse NSA and CISA assessment findings to analyze ADCS relay, name-resolution poisoning, unsigned SMB, weak network-share controls, cleartext credential discovery, and unrestricted code execution.
Review assessment : AA23-278A Active Directory Misconfiguration Exploitation LabClassify AvosLocker remote administration, tunneling, credential theft, exfiltration, scripting, web-shell persistence, and the NetMonitor reverse-proxy behavior captured by the FBI YARA rule.
Review assessment : AA23-284A AvosLocker Dual-Use Tool and NetMonitor Detection AnalysisInvestigate exploitation of Confluence setup state, unauthorized administrator creation, Rclone configuration, observed user agents, product scope, and post-compromise recovery decisions.
Review assessment : AA23-289A Confluence Administrator-Creation and Exfiltration HuntInvestigate Rhysida's valid-account access, MFT evidence, Windows staging, remote execution, Azure storage utilities, process injection, cryptographic design, and ransom-note artifact.
Review assessment : AA23-319A Rhysida Staging, Cloud Transfer, and Encryptor ResearchTrace Scattered Spider from helpdesk impersonation and MFA transfer through legitimate remote tools, credential stealers, AWS discovery, Snowflake collection, response monitoring, and ESXi impact.
Review assessment : AA23-320A Scattered Spider Helpdesk-to-Cloud Intrusion AnalysisInvestigate how LockBit affiliates extracted NetScaler session material, bypassed MFA, staged an encoded DLL, required a launch key, and established command-and-control.
Review assessment : AA23-325A Citrix Bleed Session-Theft and LockBit Payload AnalysisAnalyze IRGC-affiliated compromise of Unitronics PLCs, including exposed engineering access, ladder-logic replacement, device renaming, version rollback, port changes, and HMI defacement.
Review assessment : AA23-335A CyberAv3ngers Unitronics PLC Impact ReconstructionReconstruct two ColdFusion compromises from vulnerable versions and exploit paths through web-shell decoding, credential artifacts, network reconnaissance, and failed exfiltration.
Review assessment : AA23-339A ColdFusion Web-Shell and Registry-Dump InvestigationTrace Star Blizzard from open-source persona research and rapport building through Evilginx session theft, personal-email targeting, mailbox collection, and follow-on phishing.
Review assessment : AA23-341A Star Blizzard Persona-to-Session Spearphishing AnalysisExamine SVR exploitation of TeamCity, software-build risk, EDRSandBlast defense evasion, GraphicalProton's cloud covert channel, registry collection, and server-log evidence.
Review assessment : AA23-347A SVR TeamCity Supply-Chain Foothold InvestigationCompare Play's Windows and ESXi operations, initial-access CVEs, custom discovery tooling, Group Policy distribution, intermittent encryption, and campaign-specific recompilation.
Review assessment : AA23-352A Play Ransomware Windows-to-ESXi Technical HuntAnalyze ALPHV Blackcat's social engineering, remote tooling, adversary-in-the-middle credential theft, Kerberos access, defense evasion, exfiltration, and encryptor artifacts.
Review assessment : AA23-353A ALPHV Blackcat Access and Affiliate Tooling ResearchInvestigate how Androxgh0st finds exposed application secrets, chains PHPUnit and Laravel weaknesses, exploits Apache path traversal, and repurposes stolen cloud credentials.
Review assessment : AA24-016A Androxgh0st Web Exposure and Cloud-Credential HuntReconstruct a state-government intrusion from a retained former-employee account through SharePoint credential exposure, LDAP discovery, CIFS access, and cloud scoping.
Review assessment : AA24-046A Former-Employee Account and LDAP Evidence InvestigationAssess how SVR operators target service and dormant accounts, reuse tokens, manipulate MFA enrollment, and hide authentication behind residential proxies.
Review assessment : AA24-057A SVR Cloud Identity and Session-Persistence Analysis