A Course Built for Serious Defenders
This course is designed for security professionals who want to move beyond conventional detections and develop a deeper, more durable approach to detection engineering. You will learn how to build high-order behavioral detections that identify meaningful adversary activity across Windows and Entra ID environments, while also gaining insight into how modern attackers operate in real enterprise scenarios.
Learn to develop around 20 advanced behavioral detections covering a wide range of attack techniques
Understand the detection logic step by step, not just the final query or rule
Gain exposure to how adversaries operate through command-and-control infrastructure using C2 implants and beacons
Learn how attackers steal Entra ID tokens from compromised machines and abuse them for malicious activity
Build a foundation you can apply across tools, products, and environments
Focused on resilient detections designed to withstand common evasion techniques
Built around vendor-agnostic principles that can be transferred to other platforms
Includes a single behavioral detection approach that can help cover both stolen token abuse and adversary-in-the-middle attacks
Shares a sample design showing how this detection logic can be implemented across cloud environments, regardless of SIEM or XDR platform
Structured to teach enduring detection logic rather than product-specific shortcuts
Hands-on labs use Microsoft Defender, Entra ID, and Windows telemetry as the primary learning environment
Full attack chains and adversary behaviors are emulated in realistic scenarios using C2 frameworks.
Labs include real false positives you are likely to encounter in production, along with guidance for interpreting and handling them
Scenarios are designed to help you understand not only what can be detected, but where visibility gaps exist
This course goes beyond writing detections. Throughout the training, you will also learn where important detection gaps can emerge and how to address them with compensating detections. A dedicated module focused on identifying and closing these gaps is planned for the course release thereafter.
The detection methods taught in this course are designed to extend beyond Microsoft environments. With the right telemetry, the same principles can be adapted to Linux, macOS, Azure, AWS, and GCP.
