Browse everything

Roadmaps, courses and hands-on labs — search or filter. All roadmaps · Lab catalogue

Filters 3

Filter results

Type: Hands-on labDuration: 30–60 minTopic: Blue TeamClear all

149 results — showing 1–100

Hands-on labStationX Membership

BitLocker SetupCritical Security ControlsDuration: 1 hThis lab shows the student how to setup BitLocker on a Windows 8.1 Professional system.

Hands-on labStationX Membership

Centralized MonitoringCritical Security Controls + 1 more blockDuration: 1 hIn this lab, students will learn how to ingest log data into Splunk by first manually uploading log files for analysis.

Hands-on labStationX Membership

Comparing ControlsCritical Security ControlsDuration: 1 hStudents will evaluate policies in place on a domain and apply those policies in accordance to organizational standards.

Hands-on labStationX Membership

Creation of Standard Operating Procedures for RecoveryCritical Security ControlsDuration: 1 hStudents will have access to the results of a vulnerability scan run again a sample Windows 2008 Server.

Hands-on labStationX Membership

Data Backup to Prep for RecoveryCritical Security Controls + 3 more blocksDuration: 1 hIn this lab we will simulate the recovery phase where we must perform a backup in a server environment.

Hands-on labStationX Membership

Data Downloads and ValidationCritical Security ControlsDuration: 1 hIn this lab, students will learn to validate downloads to mitigate risk.

Hands-on labStationX Membership

Force Point: DLP Email OverviewCritical Security ControlsDuration: 1 hForcepoint DLP will teach the student how to configure Forcepoint DLP to stop data loss on the email channel.

Hands-on labStationX Membership

Force Point: DLP Network OverviewCritical Security ControlsDuration: 1 hDLP network: Monitors and enforces DLP policies across several communication channels, including email, web, IM, network printing.

Hands-on labStationX Membership

Identifying Key AssetsCritical Security ControlsDuration: 1 hStudents will use nmap to identify specific assets on their network.

Hands-on labStationX Membership

Leveraging Internal Intelligence ResourcesCritical Security ControlsDuration: 1 hStudents will leverage Zenmap and Tenable Nessus vulnerability scanner in order to perform an internal scan of networked resources.

Hands-on labStationX Membership

Log Correlation & Analysis to Identify Potential IOCCritical Security ControlsDuration: 1 hWhen defending networked digital systems, attention must be paid to the logging mechanisms set in place to detect suspicious behavior.

Hands-on labStationX Membership

Monitoring and Verifying Management SystemsCritical Security Controls + 1 more blockDuration: 1 hIn this lab, students will use Nessus Essentials to assess a system for vulnerabilities and generate a detailed analysis report.

Hands-on labStationX Membership

Open and Close Ports on Windows 7Critical Security ControlsDuration: 1 hIn this lab, the student will kill some processes and close down some shares in response to a suspected threat.

Hands-on labStationX Membership

Phishing (2026)Critical Security ControlsDuration: 1 hIn this hands-on lab, students will explore the fundamentals of phishing attacks and user awareness by using the Social-Engineer Toolkit (SET) to create a phishing email and simulate a real-world…

Hands-on labStationX Membership

PhishingCritical Security Controls + 1 more blockDuration: 1 hStudents will send a phishing email using the Social Engineering Toolkit.

Hands-on labStationX Membership

Post Incident Service RestorationCritical Security ControlsDuration: 1 hIn this lab, students will focus on the recovery phase of incident response by restoring critical services on a compromised host in a post-incident environment.

Hands-on labStationX Membership

RansomwareCritical Security ControlsDuration: 1 hStudents will learn what ransomware is, observe how it works, and implement mitigation strategies to recover from a ransomware attack.

Hands-on labStationX Membership

Recover from SQL Injection AttackCritical Security ControlsDuration: 1 hAfter identifying a SQL Injection attack, students will learn about parameterized queries in back-end web servers to minimize future SQLi attacks.

Hands-on labStationX Membership

Sensitive Information IdentificationCritical Security ControlsDuration: 1 hStudents will utilize Data Loss Prevention (DLP) software to identify documents potentially containing sensitive information.

Hands-on labStationX Membership

Vulnerability Identification and RemediationCritical Security ControlsDuration: 1 hLearners will use Nmap and OpenVAS/Greenbone Vulnerability Scanner to confirm old vulnerable systems and to also discover new ones.

Hands-on labStationX Membership

Analyze SQL Injection AttackCyber Defense Incident Responder + 1 more blockDuration: 1 hStudents will Identify the use of an SQL Injection through the use of Wireshark.

Hands-on labStationX Membership

Analyze Various Data Sources to Confirm Suspected InfectionThreat Intelligence & DefenseDuration: 1 hStudents will review network traffic to confirm the presence of malicious activity using various tools including Wireshark and VirusTotal.com.

Hands-on labStationX Membership

Applying Filters to TCPDump and WiresharkCyber Defense Incident ResponderDuration: 1 hThis lab exercise is designed to allow the trainee to become familiar with applying a capture filter to TCPDump and Wireshark using Berkley Packet Filter (BPF) syntax.

Hands-on labStationX Membership

Assessing Vulnerabilities Post AddressalThreat Intelligence & DefenseDuration: 1 hStudents will use Snorby against multiple systems to identify and mitigate any vulnerabilities found.

Hands-on labStationX Membership

BitCoin Mining Web Application on Corporate NetworkThreat Intelligence & DefenseDuration: 1 hStudents will identify unauthorized activity on a corporate network.

Hands-on labStationX Membership

Block Incoming Traffic on Known PortCyber Defense Incident ResponderDuration: 1 hIn this lab, the student will respond to an incident by blocking incoming traffic on a known port from a specific IP.

Hands-on labStationX Infrastructure Labs

Can You Examine Network Communications by Using Incident Response Tools?Cyber Security Incident ResponseLevel: AdvancedDuration: 45 minIn this lab, you will examine network communications by using incident response tools.

Hands-on labStationX Infrastructure Labs

Can You Manage Logs with Scripts, Perform File Restoration, and Perform Vulnerability Scans?Cyber Security Incident ResponseLevel: AdvancedDuration: 45 minIn this lab, you will manage logs with scripts, perform file restoration, and perform vulnerability scans.

Hands-on labStationX Infrastructure Labs

Can You Perform File Restoration, Manage GPOs, and Perform OSINT?Cyber Security Incident ResponseLevel: ExpertDuration: 1 hIn this lab, First, you will prepare for backup operations, and then you will configure Windows File History and perform a backup.

Hands-on labStationX Infrastructure Labs

Can You Use GPOs and Security Templates as Part of IR?Cyber Security Incident ResponseLevel: AdvancedDuration: 1 hIn this lab, you will use GPOs and security templates as part of IR.

Hands-on labStationX Membership

Conduct Log Analysis and Cross Examination for False PositivesVulnerability Assessment AnalystDuration: 1 hStudents will confirm the validity of event-data analysis to eliminate false-positive events.

Hands-on labStationX Membership

Conduct Supplemental MonitoringCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab you implement supplemental monitoring solutions on a network using various Microsoft security tools and built-ins.

Hands-on labStationX Membership

Core Impact Web Application Penetration TestingVulnerability Assessment AnalystDuration: 1 hThis lab introduces students to the web application penetration testing suite within the Core Impact application.

Hands-on labStationX Membership

Create Custom Snort RulesNetwork Intrusion DetectionDuration: 1 hYou will configure snort as an IDS.

Hands-on labStationX Membership

Creating Recommendations Based on Vulnerability AssessmentsVulnerability Assessment AnalystDuration: 1 hStudents will use nmap and OpenVAS / Greenbone Vulnerability Scanner to confirm old vulnerable systems and discover new ones.

Hands-on labStationX Membership

Cryptography: Using GPG for Encryption and Key ManagementCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hTraining on how to use GPG with a GPG challenge at the end.

Hands-on labStationX Membership

Data Recovery with AutopsyCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hStudents will ingest and process a previously acquired forensic image using Autopsy.

Hands-on labStationX Membership

Dynamic Malware AnalysisCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hStudents will use utilize two virtual machines, inside a protected network, to observe configuration changes on a known good / clean system and all of the unusual network traffic generated by the…

Hands-on labStationX Membership

Entering Information into a CMDBThreat Intelligence & DefenseDuration: 1 hStudents will review an old asset list and enter all of the contained information into a Configuration Management Database (CMDB).

Hands-on labStationX Membership

Event Logs with AutopsyThreat Intelligence & DefenseDuration: 1 hIn this hands-on lab, students will learn the fundamentals of Windows Event Logs, including their purpose, structure, and the types of information they contain.

Hands-on labStationX Membership

Firewall Setup and ConfigurationCyber Defense Incident Responder + 1 more blockDuration: 1 hIn this lab you will perform the steps necessary to set up a pfSense firewall from the basic command line interface and then configure the firewall using the web configuration GUI on a Windows…

Hands-on labStationX Membership

Hash VerificationCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab, students will understand and use hash verification to identify and compare files and forensic images.

Hands-on labStationX Membership

Identify Whether High-Risk Systems Were AffectedCyber Defense Incident Responder + 1 more blockDuration: 1 hThe highest risk systems are the ones with Internet facing Applications.

Hands-on labStationX Membership

Implement Single System Changes in FirewallCyber Defense Incident ResponderDuration: 1 hIn this lab, you will make changes to the pfSense firewall in order to block specific ports and types of traffic.

Hands-on labStationX Membership

Implementing Least-Privilege on WindowsVulnerability Assessment AnalystDuration: 1 hLeast-privilege is an important concept across many domains (e.g., Windows server/workstation management, networking, Linux management, etc.) and requires great discipline to implement properly.

Hands-on labStationX Membership

Internet HistoryThreat Intelligence & DefenseDuration: 1 hIn this lab, students will learn how to locate, extract, and analyze internet history artifacts from a forensic disk image.

Hands-on labStationX Membership

Introduction to SquertCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab, you will learn how to use Squert to view previously generated event data detected by the sensors.

Hands-on labStationX Membership

Log Event ReportsCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab, students will identify and analyze event logs across multiple systems, learning where logs are stored and how to filter them for relevant events.

Hands-on labStationX Membership

Manual Vulnerability AssessmentCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hAs part of the defense in depth model it is vitally important to keep tabs on the events occurring on individual devices/systems.

Hands-on labStationX Membership

Manually Creating a Baseline with MD5DeepCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hStudents will create a baseline on a documents folder using md5deep.

Hands-on labStationX Membership

Microsoft Baseline Security AnalyzerCyber Defense Incident ResponderDuration: 1 hIn this lab you will use Microsoft Baseline Security Analyzer (MBSA) to perform scans of individual host computers and of groups of computers.

Hands-on labStationX Membership

MITRE - AttackNetwork Intrusion DetectionDuration: 1 hThis lab demonstrates the process that Advanced Persistent Threat (APT) actors use to gain initial access to organizations using phishing campaigns and malicious documents.

Hands-on labStationX Membership

MITRE - DefendThreat Intelligence & DefenseDuration: 1 hThis lab is designed to teach defenders how to use Mitre ATT&CK and Mitre Navigator to research potential APTs that will target their organization and how to prioritize their defensive efforts.

Hands-on labStationX Membership

Monitoring for False PositivesNetwork Intrusion DetectionDuration: 1 hIn this lab we will map a drive to a share on the network and then copy resources from a file server.

Hands-on labStationX Membership

Monitoring Network TrafficCyber Defense Incident Responder + 1 more blockDuration: 1 hIn this hands-on lab, students will learn how to monitor and analyze network activity using a combination of industry-standard security tools.

Hands-on labStationX Membership

Monitoring Network Traffic for Potential IOA/IOCNetwork Intrusion DetectionDuration: 1 hIn this lab we will replicate potentially malicious scans from the Internet against a corporate asset.

Hands-on labStationX Membership

Network Segmentation (FW/DMZ/WAN/LAN)Cyber Defense Incident Responder + 1 more blockDuration: 1 hCreate three distinct areas for this network, route traffic accordingly and lock down VPN access to the appropriate IP address.

Hands-on labStationX Membership

Nexpose: Red Team ExploitationThreat Intelligence & DefenseDuration: 1 hThe Nexpose red team exploitation lab exposes student to the impact of critical network threats from an attacker perspective.

Hands-on labStationX Membership

Open Source Password CrackingForensic Investigations and Evidence Handling + 1 more blockDuration: 1 hStudents will use John the Ripper and Cain and Abel to crack various password protected file types on a Windows machine.

Hands-on labStationX Membership

Overview of KibanaCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hStudents will become familiarized with data visualization using Kibana - one of the 3 tools included in Elastic's ELK stack, a trio of open-source applications that work together in order to meet a…

Hands-on labStationX Membership

Performing an Initial Attack AnalysisThreat Intelligence & Defense + 1 more blockDuration: 1 hStudents will use perform incident response on a compromised machine.

Hands-on labStationX Membership

Preliminary ScanningCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hStudents will utilize Nmap, a network discovery and mapping tool, to identify the systems on a network of responsibility.

Hands-on labStationX Membership

Preparing Target MediaThreat Intelligence & DefenseDuration: 1 hIn this lab, students will prepare target media for imaging using dc3dd and Disk Wipe.

Hands-on labStationX Membership

Recover from Illegal Bitcoin Mining IncidentThreat Intelligence & DefenseDuration: 1 hStudents will conduct recovery activities using Indicators of Compromise found on the victim computer and other network-related artifacts.

Hands-on labStationX Membership

Recover from Web-Based Flashpack IncidentThreat Intelligence & DefenseDuration: 1 hStudents will recover a Windows 7 client infected by an unknown payload loaded after exposure to the FlashPack Exploit Kit.

Hands-on labStationX Membership

Report Writing for Presentation to ManagementCyber Defense Incident Responder + 1 more blockDuration: 1 hIn an earlier lab, students analyzed a suspected exploit (FlashPack Exploit Kit) on a corporate machine.

Hands-on labStationX Membership

Respond to and Validate Alerts from Antivirus SoftwareThreat Intelligence & DefenseDuration: 1 hStudents will respond to and validate alerts from Antivirus software.

Hands-on labStationX Membership

Setting up Filters and Queries in KibanaCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hStudents will focus on using filters and queries in Kibana to find indicators of compromise within the network.

Hands-on labStationX Membership

Setting Up Zones in a FirewallCyber Defense Incident ResponderDuration: 1 hStudents will configure a pfSense Firewall to create/isolate various network segments.

Hands-on labStationX Membership

SNORT Configuration and Operation LabNetwork Intrusion Detection + 1 more blockDuration: 1 hThis lab will provide the student with experience in manually installing Snort and its support software, as well as with configuring Snort to behave as a Network Intrusion Detection System.

Hands-on labStationX Membership

Threat DesignationCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hStudents will conduct scans against a web server, a file share, a printer and a user's host device.

Hands-on labStationX Membership

Using Snort and Wireshark to Analyze TrafficCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab we will replicate the need for Analysts to be able to analyze network traffic and detect suspicious activity.

Hands-on labStationX Membership

Validate Indications of Compromise: Analysis of PE FileCyber Defense Forensics Analyst Training Series + 2 more blocksDuration: 1 hMalware authors frequently use certain functions, symbols and other tools as a way of building and obfuscating the true nature of their executables.

Hands-on labStationX Membership

Vulnerability Proof of Concept and RemediationVulnerability Assessment AnalystDuration: 1 hStudents will identify if a vulnerability is present in the systems and remediate the vulnerability if necessary.

Hands-on labStationX Membership

WebApp Attack PCAP AnalysisCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hIn this lab you will analyze a capture file of a web application attack in order to identify the attack vector and deduce the vulnerability the attack exploited.

Hands-on labStationX Membership

Windows Event Log Manipulation via Windows Event ViewerCyber Defense Incident ResponderDuration: 1 hIn this lab you will use Windows Event Viewer to view and filter the security event log on a Windows 7 client computer specifically for account logons.

Hands-on labStationX Membership

Advanced Techniques for Malware RecoveryMalware Analysis & Reverse Engineering Duration: 1 hStudents will use the SysInternals Suite of utilities to analyze processes, DLLs, registry edits and other auto start functions to locate and remove malicious software from an infected Windows 7…

Hands-on labStationX Membership

Analysis and Recommendation ReportMalware Analysis & Reverse Engineering Duration: 1 hStudents will do a Vulnerability Assessment on a network.

Hands-on labStationX Membership

Analyze and Classify MalwareMalware Analysis & Reverse Engineering Duration: 1 hIn this lab you will attempt to conduct basic analysis on some malware samples that were found on the internal network.

Hands-on labStationX Membership

Analyze DoomJuice Infection to Identify Attack Vector and PayloadMalware Analysis & Reverse Engineering Duration: 1 hStudents will use popular system analysis tools on an infected machine in order to identify signs of infection.

Hands-on labStationX Membership

Analyze Malicious Activity in Memory Using VolatilityMalware Analysis & Reverse Engineering Duration: 1 hStudents will use the open source Volatility tool to analyze a memory snapshot and determine what malicious software has infected the victim machine.

Hands-on labStationX Membership

Analyze Packed Executable to Identify Attack Vector and PayloadForensic Investigations and Evidence HandlingDuration: 1 hStudents will use a handful of tools to analyze a provided suspicious file.

Hands-on labStationX Membership

Analyze Structured Exception Handler Buffer Overflow ExploitRootkits & Threat DetectionDuration: 1 hStudents will identify the use of a Buffer Overflow exploit through the use of Wireshark and by analyzing items found in the captured traffic.

Hands-on labStationX Membership

Auditing Service AccountsCyber Defense Forensics Analyst Training SeriesDuration: 1 hStudents will audit service accounts in a Windows Server environment.

Hands-on labStationX Membership

Baseline Systems in Accordance with Policy DocumentationCyber Defense Forensics Analyst Training SeriesDuration: 1 hStudents are provided a whitelist of applications allowed for installation on a system.

Hands-on labStationX Membership

Conduct Root Cause Analysis for System CrashesCyber Defense Forensics Analyst Training Series + 1 more blockDuration: 1 hStudents will use utilize a specially loaded system to conduct analysis on a captured memory dump from a machine suffering from repeating system crashes.

Hands-on labStationX Membership

Control Assessment and EvaluationCyber Defense Forensics Analyst Training SeriesDuration: 1 hStudents start off the lab by reviewing are a list of security controls which are to be applied to systems on a fictitious corporate network.

Hands-on labStationX Membership

Creating a Baseline Using AutopsyCyber Defense Forensics Analyst Training SeriesDuration: 1 hStudents will run Autopsy against an existing system to create a baseline that will be used for future analysis.

Hands-on labStationX Membership

Creating a Case in OSFForensic Investigations and Evidence HandlingDuration: 1 hIn this lab students will become familiar with creating a lab in OSForensics.

Hands-on labStationX Membership

Creating a Forensic ImageCyber Defense Forensics Analyst Training SeriesDuration: 1 hIn this lab, students will learn how to create a forensic image of a removable media using FTK imager.

Hands-on labStationX Membership

Creating a List of Installed Programs, Services and User Accounts from a WIN2K12 ServerCyber Defense Forensics Analyst Training SeriesDuration: 1 hStudents will create a list of installed programs, services, and accounts in a Windows 2012 server environment using various tools and methods.

Hands-on labStationX Membership

Denial of Service PCAP AnalysisCyber Defense Forensics Analyst Training SeriesDuration: 1 hThe student will act as attacker and defender in this scenario.

Hands-on labStationX Infrastructure Labs

Design, Defend, and Respond Across an End-to-End Security ArchitectureSecurity Operations PractitionerLevel: ExpertDuration: 1 hIn this lab, you will complete an end-to-end capstone scenario spanning architecture, engineering, monitoring, hunting, and incident response.

Hands-on labStationX Membership

Detect Embedded Shellcode in a Microsoft Office DocumentMalware Analysis & Reverse Engineering Duration: 1 hMalware can take many forms.

Hands-on labStationX Infrastructure Labs

Enforce Segmentation and Approved Access PathsSecurity Operations PractitionerLevel: GuidedDuration: 1 hIn this lab, you will enforce segmentation and approved access paths.

Hands-on labStationX Infrastructure Labs

Establish a Windows Hardening and Security Logging BaselineSecurity Operations PractitionerLevel: GuidedDuration: 1 hIn this lab, you will harden a Windows endpoint to reduce common attack paths.

Hands-on labStationX Infrastructure Labs

Establish centralized logging by onboarding hosts and validating monitoring readinessSecurity Operations PractitionerLevel: GuidedDuration: 1 hIn this lab, you will ensure monitoring readiness through centralized logging.

Hands-on labStationX Membership

Event Log Collection with SplunkCyber Defense Forensics Analyst Training SeriesDuration: 1 hIn this lab you will use Splunk Enterprise to ingest logs from a local host for analysis Duration: 2 hours

Hands-on labStationX Membership

FTK Analysis & ReportingForensic Investigations and Evidence HandlingDuration: 1 hThe FTK Imaging & Analysis lab is focused on building incident handling skills.

Hands-on labStationX Infrastructure Labs

Govern, Detect, Hunt, and Respond Through an Integrated Security Operations SprintSecurity Operations PractitionerLevel: AdvancedDuration: 1 hIn this lab, you will complete an integrated security operations sprint that combines tasks from labs 8-13.

Browse everything

Filter results

Type

Lab difficulty

Duration

Exam

Topic

Included in