• 1. Introduction and Fundamentals
  • Introduction to Threat Hunting
  • Overview of DFIR lifecycle
  • Windows logging architecture
  • Key concepts and terminology
• 2. Detection Engineering
  • Detection lifecycle
  • Developing Hybrid signals
  • Real World Case studies
• 3. MITRE Frameworks
  • ATT&CK vs Cyber Kill Chain
  • D3FEND mitigations
  • Engage for active defense
• 4. Initial Access & Credential Hunting
  • Learn commonly abused TTPs for Initial Access
  • Hunt for Evidence of Adversary who has Breached the Perimeter
  • Hunt for Malicious Credential Usage
• 5. Persistence & ASEP Hunting
  • Learn about ASEP and commonly abused TTPs for Persistence
  • Hunt for Evidence of Adversary across ASEP locations
  • Hunt for Advanced Persistence Techniques
• 6. Lateral Movement Hunting
  • Learn about Windows built-in techniques abused for Lateral Movement
  • Learn to scope your Hunt and Incident Response by tracking attacker footprints
  • Tracking Credentials for Hunting Lateral Movement
• 7. Malware Analysis
  • Techniques for static malware analysis
  • Dynamic analysis methods
  • Tools and resources for malware analysis
  • Sigma and Yara rules
  • Introduction to reverse engineering
  • Tools and techniques for reversing malware
• 8. Network Hunting
  • Hunting for Malware Beacons
  • Hunting DNS exfiltration
  • Hunting for Domain Fronting Techniques
• 9. Incident Response
  • NIST Framework for Incident Response
  • Hand-off from Threat Hunting findings to drive Incident Response
  • Incident Containment and Next Steps
• 10. Digital Forensics
  • Forensics Evidence Acquisition and Handling
  • Tools for collecting Forensic Evidence
  • Disk and Filesystem Forensics
  • Memory Forensics
  • Anti-Forensic Techniques
• 11. Threat Intelligence
  • Diamond Model for Threat Intelligence
  • Consuming Threat Intel to drive Operations
  • Producing Threat Intel from concluded Incident
• 12. Capstone Exercise Challenge
  • Hands-on analysis challenge to hunt threats and perform DFIR
  • Full attack chain reconstruction
  • Produce Executive and Technical reports
• Lab
  • Detection Engineering Lab Setup 
  • Hands-on writing windows detection 
  • Hands-on writing complex multi source detection 
  • Proactive Hunt for confirming presence of adversary 
  • Hunt for credential abuse 
  • Hunt for evidence of adversary across persistence points 
  • Hunt for advanced persistence techniques 
  • Evidence identification for Lateral Movement 
  • Hunt for detection of Lateral Movement 
  • Credential Tracking for Lateral Movement Hunting 
  • Malware Analysis Lab Setup 
  • Static Malware Analysis 
  • Dynamic Malware Analysis 
  • Hunting for Malware via YARA rules 
  • Network Hunting for Malware Beacons 
  • Network Hunting for DNS Exfiltration 
  • Network Hunting for Domain Fronting Techniques 
  • Hands-on Hunting Report Writing with Hand off to Incident Response Teams 
  • Forensics Evidence Acquisition 
  • Analysing Disk Image 
  • Analysing Memory Image 
  • Analysing Filesystem Image 
  • Writing Threat Intel Reports 
  • Final Exercise Challenge

• Malware Analysts
• Digital Forensic Investigators
• Cyber Security Analysts
• Network Security Engineers
• Red Team Members/Penetration Testers
• Incident Response Team Members

• Familiarity of Window and Linux at log level
• Comprehensive understanding of Information Security and its terms
• Basics of Networking
• Experience in Cyber Security is highly recommended

Upon completion of the course, participants will be able to:

• Explain threat hunting workflows, DFIR lifecycle stages, and identify critical Windows artifacts.
• Create detection rules using MITRE ATT&CK (TTP mapping) and develop hypotheses for proactive hunting.
• Detect credential abuse, lateral movement, and persistence mechanisms while performing basic static/dynamic malware analysis.
• Acquire and analyze disk, memory, and registry artifacts, and use open-source tools to build artifact timelines.
• Contain threats using NIST SP 800-61 principles and document findings for handoff to DFIR teams.
• Map adversary behaviors to MITRE D3FEND mitigations and generate actionable alerts from STIX reports.
• Investigate full attack chains—from initial access to exfiltration—and produce both technical and executive reports for mock breaches.