← All trainingCourse in Guardian Foundry
PHANTOM
Investigate a supply-chain compromise using a case artifact pack. Extract indicators, write YARA, Snort and Sigma detections, develop a threat hunt and assemble an incident report.
What you’ll practice
- Extract and analyze indicators of compromise from case artifacts.
- Write detection rules in YARA, Snort and Sigma and develop a threat hunt query.
- Document the investigation and supporting evidence in an incident report.
Topics
- Incident response
- Detection engineering
- Threat hunting
Counts include distinct published activities in this course. Answer-based activities and labs count as exercises; assessments are separate. Repeated activities in a learning path count once.