SEC564: OnDemand

Provided by

Enquire about this course

What You Will Learn

In SEC564, you will learn how to plan and execute an end-to-end adversary emulation, including how to plan and build a red team program, leverage threat intelligence to map against adversary tactic, techniques, and procedures (TTPs), emulate TTPs, report and analyze the results of red team exercises, and ultimately improve the overall security posture of the organization.

You will do all of this in a course-long exercise, in which we perform a adversary emulation against a target organization modeled on an enterprise environment. This environment includes Active Directory, email, web, and file servers, as well as endpoints running the latest operating systems. We will start by consuming cyber threat intelligence to identify and document an adversary that has the intent, opportunity, and capability to attack the target organization. You will discover the TTPs used by the adversary while creating an adversary emulation plan leveraging MITRE ATT&CK (Adversary Tactics, Techniques, and Common Knowledge).

We'll cover the planning phase of these exercises, showcasing various industry frameworks and methodologies for red teaming and adversary emulation. These frameworks are industry standards used by various regulatory bodies to ensure consistent and repeatable red team exercises.

Using strong planning and threat intelligence, students will follow the same unified kill chain as the adversaries to reach the same objective, from setting up attack infrastructure with command and control to emulating multiple TTPs mapped to MITRE ATT&CK.

The course concludes with exercise closure activities such as analyzing the response of the blue team (people and process), reporting, and remediation planning and retesting. Finally, you will learn how to show the value that red team exercises and adversary emulations bring to an organization. The main job of a red team is to make a blue team better. Offense informs defense and defense informs offense.

This Course Will Prepare You To:
  • Build a Red Team program
  • Leverage Red Team exercises and adversary emulation to obtain a holistic view of an organization's security posture
  • Measure, train, and improve people, processes, and technology for the organization
You Will Receive With This Course:
  • Two Virtual Machines:Windows 10 and SANS Slingshot C2 Matrix Edition which includes multiple Red Team tools for all exercises including Command and Control Frameworks (C2)
  • Cheat Sheets
  • Frameworks and Methodologies
  • Threat Intelligence reports for two popular threat actors/adversaries
  • Sample Adversary Emulation Plan
Additional Resources:
  • C2 Matrix
  • Red Team Development and Operations: A practical guide by Joe Vest and James Tubberville
  • Using MITRE ATT&CK for Cyber Threat Intelligence Training


Start date Location / delivery
No fixed date Virtual Book now

Related article

At GIAC, we believe that hands-on testing is the future of cybersecurity certification. With five certification exams featuring CyberLive , and thr...