Courses Catalog

FOR572 is an advanced course designed for cybersecurity professionals seeking to master network forensics, threat hunting, and incident response. The course focuses on deep packet analysis, intrusion detection, and uncovering adversary activity within large-scale enterprise environments. Participants will learn how to analyze network traffic, identify anomalies, and reconstruct cyber attacks using tools such as Zeek (Bro), Suricata, Wireshark, and Security Information and Event Management (SIEM) solutions.

FOR589 is a five-day intermediate-level course that takes professionals deep into the world of cybercriminal ecosystems. Participants learn how to apply structured investigative thinking to cyber threats — from profiling threat actors and navigating dark web communities to tracing illicit cryptocurrency transactions across blockchain networks. The course covers undercover operational techniques, including persona management and HUMINT collection, giving analysts the tools to safely infiltrate and monitor underground forums and marketplaces. With over 20 hands-on labs and a final capstone exercise, students gain practical experience turning fragmented intelligence into actionable, evidence-based findings. The course is designed for cyber threat intelligence analysts, digital forensics professionals, and incident responders who want to bridge the gap between traditional investigation methods and the modern cybercrime landscape.

Learn the fundamentals of DevSecOps to understand what it means, why it matters, and how to implement it within your organization. With DevSecOps, one size doesn’t fit all, and it’s not just a matter of implementing a handful of tools or concepts. It’s about understanding what makes sense for your use case and requirements, and what approaches are most relevant. It’s also about understanding how to go from zero to the first few steps of implementation, and how to track progress along the way. Regardless of whether you’re starting from scratch with a brand new application, or whether you’re dealing with a mature product and organization, that’s what this course focuses on helping you achieve.

Elevate your security analysis skills with the Kusto Query Language (KQL) training course, offering hands-on experience in a hyper-realistic lab environment! Whether you’re a security analyst or incident responder utilizing Microsoft Sentinel, Defender for Endpoint, or Microsoft 365 Defender XDR, or simply aspiring to master the KQL for security analysis, this course is for you!

SEC670 dives deep into the art of Red Team operations, focusing on the development of custom tools for Windows environments. Participants will learn how to craft stealthy, highly effective tools to bypass modern defenses, evade detection, and simulate real-world adversary techniques. Through hands-on labs and expert-led instruction, students will explore low-level programming, process injection, API hooking, and more. Ideal for penetration testers, Red Teamers, and security researchers, this course equips professionals with the skills to create undetectable attack frameworks, ensuring they stay ahead in the evolving cybersecurity landscape.

Blitzscaling Security: Diary of a Security Engineer by Sparc Flow chronicles the journey of Alex, the inaugural security engineer at a rapidly growing startup. The narrative delves into Alex’s experiences, from the interview process to the initial months of establishing security protocols. It highlights interactions with various teams, communication challenges, vulnerability prioritization, and the tension between conventional security wisdom and practical application. The book emphasizes pragmatism and first principles, aiming to debunk prevalent myths in the security field that may be counterproductive.

Michael Bazzell has helped hundreds of celebrities, billionaires, and everyday citizens disappear completely from public view. He is now known in Hollywood as the guy who “fixes” things. Many of his previous books about privacy were mostly REACTIVE and he focused on ways to hide information, clean up an online presence, and sanitize public records to avoid unwanted exposure. This textbook is PROACTIVE. It is about starting over. It is the complete guide that he would give to any new client in an extreme situation. It leaves nothing out and provides explicit details of every step he takes to make someone completely disappear, including legal documents and a chronological order of tasks. For many, this is the only manual needed to secure a new private life.

It is time to look at OSINT in a different way. For many years, and within previous editions of this book, we have relied on external resources to supply our search tools, virtual environments, and investigation techniques. We have seen this protocol fail us when services shut down, websites disappear, and custom resources are dismantled due to outside pressures. This book aims to correct our dilemma. We will take control of our investigative resources and become self-reliant. There will be no more need for online search tools; we will make and host our own locally. We will no longer seek pre-built virtual machines; we will create and configure our own. The new OSINT professional must be self-sustaining and possess their own tools and resources. You will become a more proficient subject matter expert who will be armed with the knowledge and readiness to articulate the sources of your findings. This new 11th edition contains hundreds of pages which have been updated to keep your OSINT investigative methods fresh. It also includes new online and offline search tools and a new Debian Linux OSINT virtual machine. Brand-new search methods for Facebook, Instagram, TikTok, LinkedIn, YouTube, and others ensure you have the latest techniques within your online investigation arsenal. An entire section is devoted to Methodology, Workflow, Documentation, and Ethics which provides a clear game plan for your next active investigation. All digital files are included via download. Today, we start over.

EC-Council’s Certified Threat Intelligence Analyst (CTIA) certification is a comprehensive specialist-level professional program focused on the ever-evolving domain of threat intelligence. The program is designed for individuals involved in collecting, analyzing, and disseminating threat intelligence information. CTIA covers a wide range of topics, including the fundamentals of threat intelligence, the use of threat intelligence tools and techniques, and the development of a threat intelligence program. The cyber threat intelligence course focuses on refining data and information into actionable intelligence that can be used to prevent, detect, and monitor cyber-attacks. The program addresses all the stages involved in the threat intelligence lifecycle, and this attention toward a realistic and futuristic approach makes CTIA one of the most comprehensive threat intelligence certifications in the market today.

This course helps create and understand low-level Linux attack paths, improve your Linux detection coverage, see in action many Open Source DFIR/defensive projects, and understand the need for Linux telemetry, especially including Kubernetes clusters where Runtime Security solutions are a must these days. The techniques and attack paths covered in this training include many different implementations of eBPF, XDP, Ftrace, Kprobe, Uprobe, Netfilter, Systemtap, PAM, SSHD, HTTPD/Nginx, LD_PRELOAD-based code samples, and PoCs. Detection and forensics layers include LKRG, bpftool, Velociraptor IR, OSQuery, CLI-based /proc/ and /sys/ analysis, memory forensics with Volatility  2/3 Framework with the semi-automated RAM acquisition, Sysmon4Linux, Falco, Tracee, Sysdig, Tetragon, Sandfly Security, Zeek IDS, Suricata IDS, Moloch/Arkime FPC, Yara rules and more.

In Adversary Tactics: Vulnerability Research for Operators, you will learn an operator-focused approach to find the vulnerabilities needed to escalate privileges, execute arbitrary code, or facilitate lateral movement in Windows environments. We will give you the methodology and identify tools to find these weaknesses during active operations, when costly lead time and dedicated lab environments are unavailable. This course covers the vulnerability classes that SpecterOps routinely finds on engagements and dives into their root causes, identification techniques, and exploitation methods.

LEG523 is a specialized course designed to provide participants with a comprehensive understanding of the legal frameworks and regulatory environments that govern cybersecurity and data privacy. This course is ideal for legal professionals, compliance officers, and cybersecurity practitioners who need to navigate the complex intersection of technology and law.