Phishing & Email Threat Analysis

Not Started

Analyze reported phishing emails, extract IOCs, and verify SPF/DKIM configurations.

Firewall Log Review

Not Started

Read and interpret basic firewall deny/allow logs, identify suspicious IPs, and generate a simple report.

Intro to SIEM Alerting

Not Started

Configure basic SIEM alert rules for failed logins, set severity thresholds, and triage your first alerts.

Malware Sample Identification

Not Started

Use static analysis tools to classify malware samples by type, extract hashes, and look up IOCs in public threat intel feeds.

Endpoint Security Baseline

Not Started

Audit an endpoint for missing patches, disabled antivirus, and weak configurations using a CIS benchmark checklist.

Network Security Fundamentals

Not Started

Entry-level network defense: discover hosts, analyze firewall logs, and configure SNMPv3 monitoring.

Switch Port Security

Not Started

Enable port security, configure MAC address sticky learning, and disable unused ports on a core switch.

DNS Security Basics

Not Started

Configure DNS filtering, enable DNSSEC, and identify malicious domain queries in logs.

VPN Configuration Basics

Not Started

Set up a basic site-to-site IPsec VPN, verify connectivity, and review tunnel logs.

Network Device Hardening

Not Started

Apply CIS-recommended hardening to routers and switches: disable Telnet, enable SSH, restrict SNMP communities.

Incident Response Lifecycle Intro

Not Started

Walk through NIST IR lifecycle: prepare, detect, contain, eradicate, recover. Document a simulated low-severity alert.

Host Isolation Procedure

Not Started

Identify a compromised workstation, isolate it from the network, and collect basic triage artifacts.

Evidence Collection Basics

Not Started

Learn chain-of-custody procedures, image a USB drive, and hash-verify the image using MD5/SHA256.

Malware Alert Triage

Not Started

Receive an AV alert, verify true/false positive status, escalate if needed, and fill out an incident ticket.

Password Spray Detection

Not Started

Detect a low-and-slow password spray attack in authentication logs and block the offending IP range.

Intro Vulnerability Scanning

Not Started

Run an unauthenticated Nessus scan against a single subnet and review the output for critical findings.

CVSS Score Interpretation

Not Started

Evaluate five CVEs using the CVSS v3.1 calculator, rank them by environmental score, and recommend remediation priority.

Patch Verification Exercise

Not Started

Confirm that KB patches are applied on Windows hosts, compare system versions to CVE advisories, and document compliance.

Open Port Audit

Not Started

Use Nmap to audit all listening ports on the DMZ, compare results to the approved service list, and flag anomalies.

Vulnerability Report Writing

Not Started

Take raw scanner output and write an executive-friendly vulnerability report with risk ratings and remediation steps.

VLAN Segmentation Intro

Not Started

Create VLANs for server, user, and guest traffic. Apply inter-VLAN routing policies.

Network Monitoring with SNMP

Not Started

Configure SNMPv3 on network devices, set up a monitoring dashboard, and create threshold alerts.

Subnetting Lab

Not Started

Design an IP addressing scheme for a three-site network using VLSM, allocating appropriate ranges per department.

Wireless Network Security Basics

Not Started

Configure WPA3 on an access point, create a guest SSID with captive portal, and audit client associations.

Network Troubleshooting Fundamentals

Not Started

Diagnose three simulated network outages using ping, traceroute, and show commands on a Cisco switch.

Active Directory Basics

Not Started

Build an AD OU structure, apply security GPOs, and manage patch deployment via WSUS.

Linux Server Hardening

Not Started

Secure a fresh Ubuntu server: disable root SSH, configure UFW, apply CIS Level 1 benchmarks, and set up fail2ban.

Backup and Recovery Basics

Not Started

Configure a daily backup job for critical files, test restoration to a sandbox, and document the recovery procedure.

User Account Management

Not Started

Create, modify, and disable user accounts using AD and PowerShell scripts. Enforce password complexity policies.

Certificate Authority Setup

Not Started

Stand up a basic internal PKI with a two-tier CA hierarchy, issue a TLS certificate to a web server, and verify the chain.

File System Forensics Intro

Not Started

Browse an NTFS filesystem image using Autopsy; identify deleted files, timestamps, and metadata.

Browser Artifact Analysis

Not Started

Extract browser history, cookies, and downloads from a forensic image to reconstruct user activity.

Windows Event Log Analysis

Not Started

Filter Security, System, and Application event logs to identify login anomalies and service crashes.

Hash Verification & Chain of Custody

Not Started

Verify integrity of forensic evidence using MD5/SHA256 hashing, and complete a chain-of-custody form.

Basic Network Packet Capture

Not Started

Capture live traffic with Wireshark, filter by protocol, and identify plaintext credentials in the capture.

OSINT Fundamentals

Not Started

Use open-source tools (Shodan, Maltego, VirusTotal) to gather threat intelligence about a target domain.

IOC Classification

Not Started

Classify a list of indicators (IPs, domains, hashes) by type and confidence level using a structured threat intel format.

MITRE ATT&CK Navigator Intro

Not Started

Map a set of observed TTPs to the ATT&CK framework using Navigator, identify coverage gaps.

Threat Feed Integration

Not Started

Subscribe to a free threat feed, import IOCs into the SIEM, and create detection rules based on feed data.

Social Engineering Awareness Analysis

Not Started

Review phishing campaigns, analyze social engineering TTPs, and produce an awareness report for end users.

Security Architecture Fundamentals

Not Started

Identify security design principles (defense in depth, least privilege) and apply them to a simple network diagram.

Trust Boundary Mapping

Not Started

Identify trust boundaries in a three-tier web application and document data flows and control points.

Security Requirement Documentation

Not Started

Translate business requirements into security controls using NIST 800-53, document in a security plan template.

Encryption Standards Review

Not Started

Compare symmetric and asymmetric algorithms, evaluate TLS versions in use, and recommend secure configurations.

Cloud Security Fundamentals

Not Started

Review AWS shared responsibility model, identify misconfigured S3 buckets, and apply least-privilege IAM policies.

Cybercrime Evidence Basics

Not Started

Identify digital evidence types, proper seizure procedures, and legal considerations for computer crime investigations.

Email Header Investigation

Not Started

Analyze email headers to trace origin, identify spoofed addresses, and correlate with known threat actors.

Social Media Investigation OSINT

Not Started

Use OSINT tools to build a profile of a suspected cybercriminal from public social media and forum activity.

Report Writing for Investigations

Not Started

Write a factual, legally defensible investigation report from a set of digital evidence artifacts.

Network Log Investigation

Not Started

Analyze proxy and firewall logs to identify unauthorized data access and build a basic incident timeline.

Reconnaissance Basics

Not Started

Conduct passive and active reconnaissance on a target range using whois, DNS enumeration, and Nmap.

Linux Command Line Basics

Not Started

Master essential Linux commands for offensive operations: file manipulation, process inspection, and basic networking.

Scripting for Security

Not Started

Write basic Python and Bash scripts to automate port scanning, file hashing, and log parsing tasks.

Web Application Testing Basics

Not Started

Use Burp Suite Community edition to intercept HTTP traffic, modify requests, and identify input fields for testing.

Kali Linux Environment Setup

Not Started

Configure a Kali Linux attack workstation, update tools, configure anonymization, and verify lab connectivity.