1.
TRAINING
1.1.
Intro
1.1.1.
Lab Access
1.2.
Havoc C2
1.2.1.
Lab - Havoc C2 Basics
1.3.
Hunting & Telemetry
1.3.1.
Sysmon
1.3.2.
Logging & EventID's
1.3.3.
Velociraptor
1.4.
Processes, Tokens & DLL's
1.5.
Privilege Escalation
1.5.1.
Unquoted Service Path
1.5.1.1.
Lab - PrivEsc
1.5.2.
UAC Bypass
1.5.2.1.
Lab - UAC Bypass
1.5.3.
Token Manipulation
1.5.3.1.
Lab - Token theft
1.5.3.2.
Lab - Injection
1.6.
Windows Defender
1.7.
.NET & CLR
1.7.1.
AMSI
1.7.1.1.
Lab - AMSI/Powershell
1.7.2.
ETW
1.7.2.1.
Lab - ETW
1.7.3.
Lab - PS Loader
1.7.4.
Detections & IOCS's
1.8.
Static Analysis
1.8.1.
Yara
1.8.2.
Lab Static Analysis
1.8.3.
Detections & IOC's
1.9.
Win32API & Functions
1.9.1.
VirtualAlloc
1.9.2.
VirtualProtect
1.9.3.
WriteProcessMemory
1.9.4.
CreateThread
1.9.5.
WaitForSingleObject
1.10.
Shellcode & Loaders
1.10.1.
Compilation
1.10.2.
Lab - Shellcode
1.10.3.
P/INVOKE Loader
1.10.3.1.
Lab - Phase 1
1.10.3.1.1.
Lab - I.R.
1.10.3.1.2.
Lab - Forensics
1.10.3.2.
Lab - Phase 2
1.10.3.2.1.
Lab - Forensics
1.10.3.3.
Lab - Phase 3 Modularity
1.10.4.
Lab - XOR Loader
1.10.5.
Lab - Staged Loader
1.10.6.
AMSI & .NET
1.10.6.1.
Lab - AMSI/ETW Loader
1.10.7.
D/INVOKE Loader
1.10.8.
Lab - SandLoader
1.10.9.
Anti-Emulation
1.10.10.
Lab - Final Loader
1.10.11.
CONCLUSION
Light (default)
Rust
Coal
Navy
Ayu
Threat Hunting Academy (c) 2025 Vanguard Security - All Rights Reserved
Hunting & Telemetry