Blue TeamExpertPath Preview

APT Threat Hunter Path

Shift from reactive monitoring to proactive defense by mastering the techniques needed to discover hidden adversaries within enterprise networks. This path covers hypothesis-driven hunting, leveraging SIEM/EDR telemetry, analyzing behavioral anomalies, mapping attacker TTPs to the MITRE ATT&CK framework, and uncovering advanced persistent threats (APTs) before they trigger alerts.

22 modules204 submodules24 machines156h

KWD 430.000KWD 615.000

Purchase Elite+ path Sign Up Free

Path Curriculum

22 modules - 204 submodules

Hunt Philosophy & Methodology5 submodules - preview module

Establish the mental model behind structured threat hunting — the PEAK cycle, hypothesis generation from real CTI, and how to document and map hunts to kill chains and ATT&CK.

PEAK Hunt Cycle (Prepare → Execute → Act → Know)

IntermediateTheory

Environment Setup & Data Sources7 submodules - locked

Unlock this path to access the full module overview and activities.

ELK stack and OpenSearch setup

IntermediateTheory

Velociraptor deployment (agentless hunt at scale)

IntermediateTheory

osquery fleet setup

IntermediateTheory

Zeek and Arkime for network

IntermediateTheory

Sysmon v15 tuned config (SwiftOnSecurity + custom rules)

IntermediateTheory

Azure Sentinel, AWS Security Lake, and Chronicle comparison

IntermediateTheory

Lab: Multi-stack hunt environment, ingest real APT telemetry

IntermediateMachine

Threat Intelligence Integration5 submodules - locked

Unlock this path to access the full module overview and activities.

Structured CTI consumption (STIX/TAXII, MISP)

IntermediateTheory

Diamond model for actor profiling

IntermediateTheory

MITRE ATT&CK Navigator — pivot from actor to hunt

IntermediateTheory

Pivoting on infrastructure IOCs (passive DNS, JARM, FOFA/Shodan)

IntermediateTheory

Lab: Volt Typhoon TTP extraction and hunt queries

IntermediateMachine

Windows Endpoint Hunting19 submodules - locked

Unlock this path to access the full module overview and activities.

Prefetch, SRUM, Amcache, Shimcache

IntermediateTheory

BAM/DAM, WER forensics, RecentFileCache

IntermediateTheory

Phantom execution artifacts and timeline super-correlation

IntermediateTheory

WDAC/AppLocker bypass artifacts

IntermediateTheory

AMSI bypass detection in logs

IntermediateTheory

Constrained Language Mode evasion artifacts

IntermediateTheory

JEA (Just Enough Administration) abuse

IntermediateTheory

PSReadLine hunting

IntermediateTheory

Classic injection: CreateRemoteThread, VirtualAllocEx

IntermediateTheory

Modern injection: Process Hollowing, Doppelganging, Ghostwriting, Phantom Sections

IntermediateTheory

ETW detection of injection primitives

IntermediateTheory

Detecting shellcode via memory anomalies

IntermediateTheory

Lab: Detect 5 injection techniques from EDR telemetry

IntermediateMachine

Vulnerable driver database (loldrivers.io)

IntermediateTheory

Kernel callback removal detection

IntermediateTheory

DSE (Driver Signature Enforcement) bypass artifacts

IntermediateTheory

PPL (Protected Process Light) abuse detection

IntermediateTheory

EDR self-protection bypass artifacts

IntermediateTheory

Lab: Detect BRc4 BYOVD chain from real telemetry

IntermediateMachine

Memory Forensics6 submodules - locked

Unlock this path to access the full module overview and activities.

Volatility 3 — process analysis, malfind, handles

IntermediateTheory

MemProcFS for live analysis

IntermediateTheory

Detecting hollowed processes and injected shellcode

IntermediateTheory

Hunting C2 beacons in memory

IntermediateTheory

Rootkit detection (DKOM, IAT/EAT hooks)

IntermediateTheory

Lab: Extract C2 config from memory dump (Cobalt Strike + Sliver)

IntermediateMachine

Modern C2 Detection10 submodules - locked

Unlock this path to access the full module overview and activities.

Cobalt Strike — malleable C2 profile fingerprinting

IntermediateTheory

Sliver — config parsing, traffic patterns, stage detection

IntermediateTheory

Havoc Demon — HTTP/SMB channels, team server fingerprinting

IntermediateTheory

Brute Ratel C4 — evasion characteristics, detection gaps

IntermediateTheory

Mythic — payload identification across agents

IntermediateTheory

JA3/JA4/JA4+ fingerprinting for C2 TLS

IntermediateTheory

JARM active fingerprinting

IntermediateTheory

HTTP C2 traffic behavioral analysis (beacon jitter, sleep patterns)

IntermediateTheory

DNS C2: query rate, entropy, NXDOMAIN patterns

IntermediateTheory

Lab: Identify C2 framework blind from PCAP (4 frameworks)

IntermediateMachine

Network & Protocol Hunting8 submodules - locked

Unlock this path to access the full module overview and activities.

Zeek scripting for protocol anomaly detection

IntermediateTheory

SMB lateral movement patterns (PsExec, CrackMapExec, Impacket)

IntermediateTheory

RDP: NLA bypass, session hijacking artifacts

IntermediateTheory

WinRM/WS-Management hunting

IntermediateTheory

DCOM lateral movement (MMC20, ShellWindows)

IntermediateTheory

Pass-the-Hash/Ticket network indicators

IntermediateTheory

Encrypted traffic analysis without decryption

IntermediateTheory

Lab: Identify lateral movement chain from Zeek logs

IntermediateMachine

Identity & Authentication Hunting17 submodules - locked

Unlock this path to access the full module overview and activities.

Shadow Credentials (msDS-KeyCredentialLink)

IntermediateTheory

ADCS attacks: ESC1–ESC8 detection artifacts

IntermediateTheory

noPac / CVE-2021-42278+42287 detection

IntermediateTheory

Resource-Based Constrained Delegation abuse

IntermediateTheory

SID History injection detection

IntermediateTheory

AdminSDHolder abuse

IntermediateTheory

Lab: Detect full AD compromise chain from event logs

IntermediateMachine

Conditional Access policy bypass artifacts

IntermediateTheory

PRT (Primary Refresh Token) theft and abuse

IntermediateTheory

Device code phishing detection

IntermediateTheory

Service principal abuse, app registration attacks

IntermediateTheory

Cross-tenant access attacks

IntermediateTheory

Managed Identity token theft

IntermediateTheory

Lab: Detect OAuth and service principal abuse

IntermediateMachine

AADInternals detection signatures

IntermediateTheory

ADFS token signing cert theft artifacts

IntermediateTheory

Cross-cloud SAML federation abuse

IntermediateTheory

Cloud Hunting20 submodules - locked

Unlock this path to access the full module overview and activities.

Azure Resource Manager abuse (ARM templates as persistence)

IntermediateTheory

Azure Automation Account abuse

IntermediateTheory

Azure Arc exploitation

IntermediateTheory

Logic App abuse for C2

IntermediateTheory

Storage account SAS token hunting

IntermediateTheory

CloudTrail analysis: key events for compromise

IntermediateTheory

EC2 metadata SSRF and credential theft detection

IntermediateTheory

IAM privilege escalation paths (PassRole, AssumeRole)

IntermediateTheory

Lambda persistence detection

IntermediateTheory

S3 exfiltration artifacts (GetObject patterns)

IntermediateTheory

Lab: Detect SCARLETEEL-style AWS cryptojacking campaign

IntermediateMachine

Cloud Audit Logs structure

IntermediateTheory

Service Account key abuse

IntermediateTheory

Workload Identity Federation abuse

IntermediateTheory

Cloud Functions persistence

IntermediateTheory

Lab: Detect GCP lateral movement from audit logs

IntermediateMachine

Abusing legitimate cloud services for C2 (Azure Blob, S3, GDrive)

IntermediateTheory

Cloudflare Workers as C2

IntermediateTheory

Teams/Slack/GitHub as C2 channels — detection

IntermediateTheory

Cloud-native persistence without custom malware

IntermediateTheory

Linux & macOS Hunting12 submodules - locked

Unlock this path to access the full module overview and activities.

Auditd rule tuning for APT detection

IntermediateTheory

eBPF-based detection (Falco, Tetragon)

IntermediateTheory

Rootkit detection: /proc manipulation, LD_PRELOAD, kernel modules

IntermediateTheory

SSH key implant artifacts

IntermediateTheory

Cron/systemd persistence detection

IntermediateTheory

Container escape artifacts

IntermediateTheory

Lab: Detect Penguin Turla-style Linux rootkit

IntermediateMachine

Unified Logs analysis

IntermediateTheory

LaunchAgent/LaunchDaemon persistence

IntermediateTheory

TCC bypass artifacts

IntermediateTheory

Gatekeeper/XProtect bypass detection

IntermediateTheory

Lab: Detect Silver Sparrow-style macOS implant

IntermediateMachine

Container & Kubernetes Hunting9 submodules - locked

Unlock this path to access the full module overview and activities.

K8s audit log structure and key events

IntermediateTheory

Privileged container escape detection

IntermediateTheory

Falco rules for runtime security

IntermediateTheory

Container image supply chain: detecting poisoned images

IntermediateTheory

Kubectl abuse patterns

IntermediateTheory

RBAC misconfiguration exploitation

IntermediateTheory

Service account token theft

IntermediateTheory

etcd exposure hunting

IntermediateTheory

Lab: Detect TeamTNT-style K8s cryptominer attack

IntermediateMachine

Supply Chain & CI/CD Attacks8 submodules - locked

Unlock this path to access the full module overview and activities.

SolarWinds-style build system compromise artifacts

IntermediateTheory

GitHub Actions workflow poisoning

IntermediateTheory

Azure DevOps pipeline abuse

IntermediateTheory

Dependency confusion attack patterns

IntermediateTheory

PyPI/npm malicious package artifacts

IntermediateTheory

NPM postinstall abuse

IntermediateTheory

Detecting typosquatting package installs

IntermediateTheory

Lab: Detect CI/CD pipeline compromise from pipeline logs

IntermediateMachine

Defense Evasion Advanced11 submodules - locked

Unlock this path to access the full module overview and activities.

Windows event log tampering (Danderspritz-style tools)

IntermediateTheory

ETW provider unhooking — detection via kernel

IntermediateTheory

Userland hook detection (EDR hook bypass artifacts)

IntermediateTheory

AMSI bypass persistence (registry-based)

IntermediateTheory

Antivirus exclusion abuse hunting

IntermediateTheory

LOLBins 2025: new LOLBAS entries

IntermediateTheory

Fileless malware artifacts (WMI subscriptions, registry shellcode)

IntermediateTheory

Process argument spoofing and PEB manipulation

IntermediateTheory

Timestomping (file + registry)

IntermediateTheory

SDELETE artifacts

IntermediateTheory

Lab: Detect full evasion chain: timestomp + log clear + ETW bypass + hook

IntermediateMachine

NTFS & File System Advanced9 submodules - locked

Unlock this path to access the full module overview and activities.

$MFT forensics (Master File Table)

IntermediateTheory

$USNJrnl and $J

IntermediateTheory

$Logfile

IntermediateTheory

$I30 (directory index)

IntermediateTheory

Volume Shadow Copy forensics (VSS)

IntermediateTheory

Alternate Data Streams (ADS) advanced

IntermediateTheory

Detecting encrypted container mounts (VeraCrypt artifacts)

IntermediateTheory

ReFS forensics

IntermediateTheory

Lab: Recover deleted malware from $J + $I30 on shadow copy

IntermediateMachine

Credential Dumping & Abuse8 submodules - locked

Unlock this path to access the full module overview and activities.

LSASS dump techniques and detection (Comsvcs, Nanodump, HandleKatz)

IntermediateTheory

Kerberos attacks: AS-REP, Kerberoasting, Gold/Silver/Diamond/Sapphire tickets

IntermediateTheory

SAM hive and NTDS.dit extraction artifacts

IntermediateTheory

Cached credentials (DPAPI)

IntermediateTheory

Tokens and token impersonation

IntermediateTheory

Pass-the-Hash and Pass-the-Ticket network and host indicators

IntermediateTheory

DCSync and DCShadow detection

IntermediateTheory

Lab: Detect full credential theft chain from event and network logs

IntermediateMachine

Exfiltration Advanced8 submodules - locked

Unlock this path to access the full module overview and activities.

DNS exfiltration: dnscat2, iodine patterns

IntermediateTheory

ICMP tunneling (ptunnel, icmptunnel)

IntermediateTheory

HTTP chunked encoding exfil

IntermediateTheory

Steganography in image uploads

IntermediateTheory

Legitimate service abuse: Dropbox API, Pastebin, GitHub Gists

IntermediateTheory

Email exfiltration artifacts (M365 + on-prem Exchange)

IntermediateTheory

Cloud file share exfiltration

IntermediateTheory

Lab: Detect multi-stage exfiltration over HTTPS and DNS from Zeek

IntermediateMachine

Firmware & Hardware Implants7 submodules - locked

Unlock this path to access the full module overview and activities.

UEFI implant detection (CosmicStrand, MosaicRegressor, BlackLotus)

IntermediateTheory

BlackLotus Secure Boot bypass detection

IntermediateTheory

CHIPSEC for firmware integrity

IntermediateTheory

BMC/IPMI attack artifacts

IntermediateTheory

Thunderbolt DMA attack artifacts (Thunderspy)

IntermediateTheory

Hardware implant hunt methodology

IntermediateTheory

Lab: Detect BlackLotus-style UEFI implant from Windows event and CHIPSEC

IntermediateMachine

Detection Engineering Output9 submodules - locked

Unlock this path to access the full module overview and activities.

Sigma rule writing v2 (YAML, field mappings)

IntermediateTheory

YARA rule writing for malware artifacts

IntermediateTheory

Elastic EQL hunting queries

IntermediateTheory

KQL advanced (Sentinel/MDE)

IntermediateTheory

Splunk SPL for hunting

IntermediateTheory

YARA-L for Chronicle

IntermediateTheory

Detection-as-Code: Git-based rule management

IntermediateTheory

Testing detections with Atomic Red Team

IntermediateTheory

Lab: Write Sigma and YARA for each module's key technique

IntermediateMachine

AI-Assisted Threat Hunting7 submodules - locked

Unlock this path to access the full module overview and activities.

LLM prompting for log triage (local models, privacy)

IntermediateTheory

ML anomaly detection (Isolation Forest, LSTM for beaconing)

IntermediateTheory

Graph-based lateral movement detection (BloodHound + custom)

IntermediateTheory

UEBA: behavioral baseline deviation

IntermediateTheory

Copilot for Security hunting workflows

IntermediateTheory

Jupyter hunting notebooks (Infosec Jupyter Book)

IntermediateTheory

Lab: Build beaconing detector with Python and sklearn on real traffic

IntermediateMachine

Velociraptor & osquery at Scale6 submodules - locked

Unlock this path to access the full module overview and activities.

VQL (Velociraptor Query Language) for live hunt

IntermediateTheory

Hunt artifacts: memory, registry, filesystem at scale

IntermediateTheory

osquery scheduled queries for persistence detection

IntermediateTheory

Fleet for osquery management

IntermediateTheory

Velociraptor server-side event monitoring

IntermediateTheory

Lab: Deploy Velociraptor hunt across 50-node lab, find implant

IntermediateMachine

Real APT Campaigns 2024–20267 submodules - locked

Unlock this path to access the full module overview and activities.

Volt Typhoon — LOLBin-heavy, SOHO router C2, no malware

IntermediateTheory

Salt Typhoon — Telecom infiltration, Cisco IOS implants

IntermediateTheory

Midnight Blizzard — OAuth app abuse, Teams phishing, M365 persistence

IntermediateTheory

UNC3944 / Scattered Spider — Social engineering, cloud, and SIM swap

IntermediateTheory

APT41 — Hybrid espionage and financial, supply chain

IntermediateTheory

Edge device exploitation chains (Ivanti, Citrix, Fortinet)

IntermediateTheory

Full hunt exercise per campaign: IOCs to full timeline

IntermediateTheory

Capstone: Full IR Simulation6 submodules - locked

Unlock this path to access the full module overview and activities.

Red team plays APT (Volt Typhoon TTPs)

IntermediateTheory

Hunt from scratch: zero IOCs, hypothesis only

IntermediateTheory

Full timeline reconstruction

IntermediateTheory

Sigma and YARA detection output

IntermediateTheory

Executive report writing

IntermediateTheory

Lessons learned and detection gap analysis

IntermediateTheory

Preparing language

APT Threat Hunter Path

Path Curriculum

Full path access requires enrollment