Courses Catalog

This intensive three-day course is designed to teach the fundamental investigative techniques needed to respond to today’s cyber threats. The fast-paced course is built upon a series of hands-on labs that highlight the phases of a targeted attack, sources of evidence and principles of analysis. Examples of skills taught include how to conduct rapid triage on a system to determine whether it is compromised, uncover evidence of initial attack vectors, recognize persistence mechanisms and investigate an incident throughout an enterprise. Although the course is focused on analyzing Windows-based systems and servers, the techniques and investigative processes are applicable to all systems and applications. The course includes detailed discussions of common forms of endpoint, network and file-based forensic evidence collection and their limitations as well as how attackers move around in a compromised Windows environment. The course also explores information management that enriches the investigative process and bolsters an enterprise security program. Discussion topics include the containment and remediation of a security incident, and the connection of short-term actions to longer-term strategies that improve organizational resiliency.

Sophisticated attackers frequently go undetected in a victim’s network for an extended period. Attackers can blend their traffic with legitimate traffic that only skilled network analysts know how to detect. This course shows learners how to identify malicious network activity. The course provides an overview of network protocols, network architecture, intrusion detection systems, network traffic capture and traffic analysis. Learners review the types of network monitoring and the tools commonly used to analyze captured network traffic. The course also explores the best techniques for investigating botnets and how to use honeypots in network monitoring. The course includes lectures and hands-on lab sessions to reinforce technical concepts.

Learn everything about the latest methods of phishing, using reverse proxying to bypass Multi-Factor Authentication. Learn to think like an attacker, during your red team engagements, and become the master of phishing with Evilginx.

The training is divided in five sections: Initial foothold, Gaining access, Offensive Coding, internal reconnaissance and lateral movement. The training will cover each section in depth by providing technical evidence of how each technique works. Red team exercises are performed to assess responsiveness and detection capability. As a red teamer, it is important to understand what each tool and commands we use is doing behind the curtain to be able to provide proper guidance. The training will help you understand the tool and technique being used during a red team, develop your own toolset, adapt existing tools when needed, provide guidance on where to look for new techniques or potential evasion tricks and finally an overview of the popular technique used to perform red team exercise. Expect to perform code review, network analysis, code behavior analysis and write code to improve your red team capabilities.

The Mr.Un1k0d3r – Offensive Coding is a comprehensive program designed for those interested in the field of cybersecurity, particularly in offensive security and penetration testing. The course is led by Mr.Un1k0d3r, who is known for developing Red Team tools. One of the key aspects of this course is its focus on AV/EDR Evasion: Packer Style. This involves learning about various techniques to evade antivirus and endpoint detection and response systems, which are crucial skills for any offensive security professional. The course also includes a detailed walkthrough of the Prelude Operator 1.5 platform. This platform is used extensively in the course to demonstrate and practice various offensive coding techniques.

The SentinelOne Singularity Administration course provides comprehensive training for cybersecurity professionals. Whether you’re a seasoned system administrator or a novice threat hunter, this course caters to various roles and experience levels.

The SentinelOne University Singularity Foundations course is designed to empower cybersecurity professionals with essential knowledge and skills related to the SentinelOne Singularity platform . Whether you’re a system administrator, an IT operations specialist, or a security analyst, this course provides a solid foundation for understanding and effectively utilizing SentinelOne’s cutting-edge security technology.

The SentinelOne University Incident Response course provides participants with the knowledge and skills necessary to effectively use the SentinelOne platform for identifying and responding to incidents. Whether you’re a seasoned incident responder or just starting out, this course equips you with actionable insights and practical techniques.

SentinelOne University offers cybersecurity training programs, including a comprehensive Threat Hunting course. Whether you’re a system administrator seeking to enhance your skills or a seasoned threat hunter looking to expand your toolkit, this course has actionable and insightful content for every role and experience level. Here are the key highlights of the SentinelOne University Threat Hunting course: The course focuses on repeatable and documentable cyber threat hunting methodologies. Participants will learn about various tools that enhance the effectiveness of threat hunting. Whether you’re diving into threat hunting for the first time or refining your expertise, SentinelOne University provides the resources you need to stay ahead in the ever-evolving cybersecurity landscape.

This course covers key aspects of cybersecurity, including understanding threats, vulnerabilities, and the necessary countermeasures. It may also delve into specialized areas such as zero-day vulnerability research.

At Pwn2Own Vancouver 2021 I have demonstrated an 0day VM escape exploit for Parallels Desktop hypervisor. The exploit chain that I developed was based on logic issues. In this deep technical presentation I will share the technical details of the exploit, as well as various preliminary and contextual knowledge related to it. Logic security vulnerabilities (i.e. those that can be exploited without any memory corruptions) are becoming increasingly important in offensive security research right now, as Rust and other memory-safe programming languages are rapidly taking over popular code bases. When evaluating the attack surface of Parallels Desktop, as an expert in both hypervisors and memory corruption bugs, I saw many opportunities for classical buffer overflows, but chose to try and find a logic bug instead. As hypervisors are ultra-complex low level software, exploitable logic bugs in them are extremely rare. I was lucky to find such a “one of a kind” bug. Despite the bug was quite simple, the exploit turned out to be not so easy. Exploitation of the bug required me to develop a kernel module for the guest OS from which I was escaping, reverse-engineer some internal RPC protocol of the hypervisor, and emulate it in the exploit code. Eventually the exploit was reliable 100% by design, and executed arbitrary code on the host Mac. During the Pwn2Own competitions it came as a surprize that my exploit did not meet any collisions with other competition entries. Because the bug itself was quite easy, I expected that at least one participant would find and utilize it independently in their own Pwn2Own exploit. But it didn’t happen. That made me aware of the fact that a bug that looks easy does not necessarily imply an easy discovery or an easy exploitation process, an estimation which is very important for strategic aspects of offensive security research.

We will look into how we can bypass kASLR, kLFH, and do hands-on exploitation using data-only attack, which effectively bypasses SMEP and other exploit mitigations. Upon completion of this training, participants will be able to learn: Exploit development process in kernel mode Mitigation bypasses Pool internals & Feng-Shui Arbitrary Read/Write primitive