DETECTION ENGINEERING 100

Course Description

Acquire the essential skills to become a valuable asset in a detection engineering program. Our aim is not to teach you the basics of Cybersecurity, but rather to delve deeper into those concepts. From mastering regular expressions and analyzing log files to creating powerful detections, we will guide you every step of the way.

Building upon the foundations laid in the first half, you will become an indispensable member of a detection engineering program. Malware Analysis? We've got you covered. Attack Emulation? We've got that too.

Discover why these skills are crucial for a seasoned detection engineer and learn how to seamlessly integrate them into a Detection-as-Code pipeline.

Learning Modules

Develop the skills for cybersecurity threat detection and analysis over 10 modules, learning how to create sophisticated detection strategies for a wide range of cyber threats, both in network traffic and endpoint security. 

• Regular Expressions (Regex)

  • Learn how to use Regular Expressions to identify threats or suspicious activity

  • Access large datasets utilizing complex matching requirements.

  • 9 units, 9 quizzes, 3 labs

• Yara & Snort

  • “Yara is to files what Snort is to network traffic.”

  • Learn Yara and Snort to create detection logic for both endpoint and network traffic - basic to advanced.

  • You’ll discover tools such as: Strings, FLOSS, HxD, Ghidra, Wireshark, tshark, and more.

  • 13 units, 7 quizzes, 7 labs

• Sigma

  • Gain knowledge of the creation and implementation of “universal” Sigma detection rules.

  • Learn how to convert rules and write your own conversion backend for customized datasets.

  • You’ll discover tools such as: Visual Studio Code, pySigma, and Sigma CLI.

  • 4 units, 3 quizzes, 3 labs

• Log Analysis

  • Utilize Elastic to become familiar with analyzing ingested logs with query languages.

  • You’ll discover log sources such as: Windows Event Logs, Sysmon, Syslog, and Zeek.

  • 6 units, 6 quizzes, 6 labs

• Malware Analysis

  • Touch on the four phases of malware analysis to bolster your capabilities with detection logic: Basic Static, Basic Dynamic, Advanced Static, and Advanced Dynamic analysis.

  • You’ll discover tools such as: PEStudio, INetSim, Sysinternals Suite, RegShot, x64dbg, and more.

  • 5+ units, 5+ quizzes, 5+ labs

• Attack Emulation

  • Learn how to take threat actor behaviors and emulate them in a lab environment for analysis.

  • You’ll discover tools such as: Atomic Red Team, Caldera, C2 Frameworks, Kali Linux, and more.

  • 5+ sections, 5+ quizzes, 5+ labs

• Creating, Testing, & Tuning Detections

  • Familiarize yourself with industry frameworks and learn the difference between detection logic utilizing indicators of compromise or behaviors.

  • Begin creating detections based on a sound methodology and guidelines - starting simple and moving to advanced.

  • Learn how to document the “metadata” for your logic, including investigation and incident response steps.

  • You’ll discover frameworks such as: Pyramid of Pain, Cyber Kill Chain, and MITRE ATT&CK.

  • 12 sections, 5 quizzes, 3 labs

• Detection-as-Code / Detection Life Cycle

  • Discover “Detection-as-Code” and why it is the gold standard for detection engineering programs; documented, agile, code, version control, CI/CD pipelines, and testing.

  • 5+ sections, 5+ quizzes, 5+ labs

• Real World Review

  • Explore some real world malware, threat actor techniques, and the detections behind them.

  • 3 sections, 3 labs

• The Cloud (and additional content)

  • Cover the bases on logging and potential security implications within the major cloud providers; AWS, Azure, and GCP.

  • This section is going to continue to receive a drip of additional content post-release