TACTICAL SYLLABUS DIRECTORY • REV 2.4.9

FRAMEWORK: MITRE ATT&CK / PTES 45+ Active Labs

terminal Industrial Cyber Sandbox Operations

Technical Curriculum & Syllabus 2.0

Engineered by defensive operators and offensive penetration testers. Comprehensive 4-week operational residency syllabus encompassing 45 hands-on targets, sovereign cyber range infrastructure, and industrial attack simulations.

Sandbox Targets 45+ Guided Labs

Telemetry 120h Live Direct Drills

Tracks 06 Specializations

Drills 100% Hands-On Practice

search

TACTICAL SECTOR DOCK (CLICK ANY TRACK TO ENGAGE)

6 SECTORS • 45 GUIDED LABS • 100% HANDS-ON

TRK-01 // Offensive Wing 8 Guided Labs

terminal

Vulnerability Assessment & Penetration Testing (VAPT)

Web vulnerability exploitation, lateral network tunneling, memory corruption foundations, and active defense bypass.

Burp Suite ProMetasploitNmapChiselBloodHound

ACTIVE MISSION SECTOR

TRK-02 // Defensive Wing 7 Guided Labs

manage_search

Digital Forensics & Incident Investigation (DFIR)

Volatile memory reconstruction, cryptographic image acquisition, forensic timeline assembly, and deep packet carving.

Volatility 3AutopsyFTK ImagerWiresharkEric Zimmerman

Engage Track arrow_forward

TRK-03 // Cloud & Infra 8 Guided Labs

cloud_sync

Cloud Security Architecture & IAM Hardening

AWS/Azure misconfiguration exploitation, least-privilege IAM enforcement, and Kubernetes container breakouts.

AWS IAMCloudSploitDockerKubernetesPacu

Engage Track arrow_forward

TRK-04 // Intelligence Wing 6 Guided Labs

radar

Open-Source Intelligence (OSINT) & Threat Recon

Automated entity graphing, dark web indexing, IoT reconnaissance, and enterprise digital footprints.

Shodan CLIMaltegoCensysSpiderfoottheHarvester

Engage Track arrow_forward

TRK-05 // Blue Team Defense 8 Guided Labs

shield_with_heart

Incident Response & SOC Operations

Enterprise SIEM analysis, Sysmon behavioral detection engineering, and real-time ransomware quarantine drill.

Splunk SIEMSuricata IDSElasticSysmonWazuh

Engage Track arrow_forward

TRK-06 // Deep Tech Wing 8 Guided Labs

memory

Malware Analysis & Reverse Engineering

Static & dynamic Portable Executable dissection, Ghidra decompilation, x64dbg tracing, and YARA signature writing.

Ghidrax64dbgPEStudioYARAProcess Hacker

Engage Track arrow_forward

TRK-01 // ACTIVE SECTOR Offensive Wing 8 Guided Labs STANDARDS: PTES & MITRE ATT&CK

Vulnerability Assessment & Penetration Testing (VAPT)

Web vulnerability exploitation, lateral network tunneling, memory corruption foundations, and active defense bypass.

rocket_launch Deploy Sector Range ()

menu_book

Curriculum Phases & Guided Labs

Step-by-step offensive progression

4 Modules • 8 Labs

01

Advanced Web Application Security & OWASP Top 10:2025

WEEK 1-2

Automated and manual fuzzing, CSRF chain exploitation, SSRF to cloud metadata extraction, and SQLi bypass techniques.

Burp Suite Pro SQLmap FFUF

02

Network Reconnaissance & Defensive Evasion

WEEK 2-3

Firewall evasion with raw packet crafting, SYN/ACK stealth sweeps, NSE custom script writing, and banner manipulation.

Nmap NSE Scapy Masscan

03

Internal Pivoting, Port Forwarding & Active Directory

WEEK 3-4

Chisel tunneling, SSH dynamic SOCKS5 proxies, BloodHound graph query exploration, and Kerberoasting ticket extraction.

Chisel BloodHound Impacket

04

Memory Corruption Foundations & Metasploit Custom Exploits

WEEK 4

x86 register inspection, stack buffer overflows, shellcode injection, and meterpreter post-exploitation payloads.

Metasploit Pro GDB-Peda MSFVenom

radar

Sector Capability Radar

TRK-01 Domain Metrics

ACTIVE SWEEP

Web Exploit 95%

Network Pivot 90%

Active Directory 85%

Buffer Overflow 78%

EDR Evasion 88%

terminal

Target Simulations

8 Practical sandbox ranges

ROOT ACQUISITION

[LAB 01] OWASP JuiceShop Blind Injection

ROOT 100XP

[LAB 02] SSRF to AWS Instance Metadata Service

FLAG 150XP

[LAB 03] Network Segment Double Pivot via Chisel

PIVOT 200XP

[LAB 04] Kerberoasting Domain Controller AD

ADMIN 250XP

[LAB 05] Vanilla x86 Buffer Overflow EIP Hijack

EXPLOIT 300XP

+3 Additional Hardened Ranges Deploy Range open_in_new

TRK-02 // ACTIVE SECTOR Defensive Wing 7 Guided Labs STANDARDS: NIST SP 800-86

Digital Forensics & Incident Investigation (DFIR)

Volatile memory reconstruction, cryptographic image acquisition, forensic timeline assembly, and deep packet carving.

rocket_launch Deploy Sector Range ()

menu_book

Curriculum Phases & Guided Labs

Forensic acquisition & investigative lifecycle

4 Modules • 7 Labs

01

RAM Capture & Volatility 3 Kernel Extraction

WEEK 5

Detecting process hollowing, unlinking hidden DLLs, scanning for injected thread handles via pslist/malfind.

Volatility 3 LiME WinPmem

02

Forensic Disk Acquisition & Bitstream Carving

WEEK 6

Raw E01/DD disk images, Master File Table (MFT) parsing, Volume Shadow Copy reconstruction, and slack space salvage.

FTK Imager Autopsy X-Ways

03

Windows Registry Hives, Shimcache & Amcache Analysis

WEEK 6-7

Uncovering malware persistence in Run keys, tracking USB drive mounting records, and executable execution evidence.

Registry Explorer Eric Zimmerman Tools

04

Network Forensic Carving & TLS Stream Inspection

WEEK 7-8

Extracting exfiltrated archives from raw PCAPs, tracking beaconing cadences, and parsing HTTP/2 payloads.

Wireshark NetworkMiner Zeek

radar

Sector Capability Radar

TRK-02 Domain Metrics

ACTIVE SWEEP

RAM Memory 96%

Disk Carving 92%

Registry Hives 89%

PCAP Carving 94%

Chain of Custody 98%

search_insights

Forensic Investigations

7 Guided Evidence Labs

EVIDENCE CHAIN

[LAB 01] Unlinking Hidden DLLs from PEB via Volatility

160 XP

[LAB 02] MFT Record Reconstruction of Exfiltrated ZIP

200 XP

[LAB 03] Correlating Shimcache Timestamps with C2 Beacons

220 XP

[LAB 04] TLS Session Decryption via Pre-Master Secret Log

SOLVED 260XP

+3 Artifact Recovery Range Scenarios Deploy Range open_in_new

TRK-03 // ACTIVE SECTOR Cloud & Infra 8 Guided Labs STANDARDS: CIS AWS BENCHMARK

Cloud Security Architecture & IAM Hardening

AWS/Azure misconfiguration exploitation, least-privilege IAM enforcement, and Kubernetes container breakouts.

rocket_launch Deploy Sector Range ()

menu_book

Curriculum Phases & Guided Labs

Cloud exploitation, IAM attack chains & container breakouts

4 Modules • 8 Labs

01

Cloud Threat Surfaces & S3 / Blob Leak Exploitation

WEEK 8

Bucket policy misconfigurations, unauthenticated ACL read/write privileges, and automated data exfiltration.

CloudSploit ScoutSuite Pacu

02

IAM Escalation & Zero-Trust Policy Engineering

WEEK 9

Abusing iam:PassRole, trust policy assumption loops, and rolling out tight ABAC/RBAC guardrails.

AWS IAM Policy Sentry PMapper

03

Docker & Kubernetes Container Escaping

WEEK 9-10

Exploiting mounted host sockets (/var/run/docker.sock), privileged capability abuses, and Kubelet API hijacking.

Trivy Kube-bench CDK

04

DevSecOps CI/CD Pipeline Scanning & Hardening

WEEK 10

Integrating automated SAST/DAST gating, secret scanning in git pre-commit hooks, and container image signing.

Semgrep Gitleaks Checkov

radar

Sector Capability Radar

TRK-03 Domain Metrics

ACTIVE SWEEP

Cloud Threat 94%

IAM Escalation 96%

Container Escape 90%

Zero-Trust 88%

Audit Posture 92%

cloud_sync

Cloud Sandbox Labs

8 Cloud Range Pods

CLOUD ESCALATION

[LAB 01] AWS IAM PassRole Privilege Escalation

READY 150XP

[LAB 02] Misconfigured K8s Pod Socket Escape

READY 200XP

[LAB 03] Azure AD Federated Identity Hijack

READY 250XP

+5 Live Multi-Cloud Range Pods Deploy Range open_in_new

TRK-04 // ACTIVE SECTOR Intelligence Wing 6 Guided Labs STANDARDS: LEGAL RECON DOCTRINE

Open-Source Intelligence (OSINT) & Threat Recon

Automated entity graphing, dark web indexing, IoT reconnaissance, and enterprise digital footprints.

rocket_launch Deploy Sector Range ()

menu_book

Curriculum Phases & Guided Labs

Recon pipelines, entity correlation & dark web intelligence

3 Modules • 6 Labs

01

Shodan, Censys & Global Industrial IoT Geolocation

WEEK 10

Query filtering for unauthenticated SCADA controllers, IP camera feeds, and exposed RDP servers.

Shodan CLI Censys Fofa

02

Maltego Entity Graphs & Automated Recon Aggregators

WEEK 11

Transform pipelines linking email addresses, social accounts, phone footprints, and registrar records.

Maltego Spiderfoot theHarvester

03

Dark Web Marketplace & Ransomware Leak Monitoring

WEEK 11-12

Tor circuit configuration, .onion indexing, and automated credential breach surveillance bots.

Tor OnionScan Hunchly

radar

Sector Capability Radar

TRK-04 Domain Metrics

ACTIVE SWEEP

Shodan / IoT 96%

Entity Graphs 93%

Dark Web 91%

Digital Footprint 95%

Threat Triage 89%

manage_search

Tactical OSINT Labs

6 Field Recon Missions

RECON DOSSIER

[LAB 01] Geolocating Industrial Telemetry via Shodan

120 XP

[LAB 02] Maltego Transform Dossier: Target X

180 XP

[LAB 03] Onion Marketplace Breach Tracking

200 XP

+3 Corporate Footprint Mapping Exercises Deploy Range open_in_new

TRK-05 // ACTIVE SECTOR Blue Team Defense 8 Guided Labs STANDARDS: SIEM / EDR PLAYBOOKS

Incident Response & SOC Operations

Enterprise SIEM analysis, Sysmon behavioral detection engineering, and real-time ransomware quarantine drill.

rocket_launch Deploy Sector Range ()

menu_book

Curriculum Phases & Guided Labs

SIEM engineering, IDS signatures & threat mitigation

4 Modules • 8 Labs

01

Splunk Core & Elastic SIEM Detection Engineering

WEEK 10

Crafting complex SPL search queries, building automated alert triggers, and calculating threat baseline anomalies.

Splunk Enterprise Elastic Security

02

Suricata IDS Signature Authoring & Zeek Logging

WEEK 11

Writing custom packet matching rules for zero-day CVEs, detecting DNS tunneling, and suspicious TLS handshakes.

Suricata Zeek Snort 3

03

Live Ransomware Containment & Isolation Drills

WEEK 12

Rapid host isolation via EDR scripts, kill-switch DNS sinks, and Active Directory lockout procedures.

Wazuh EDR Sysmon Powershell

radar

Sector Capability Radar

TRK-05 Domain Metrics

ACTIVE SWEEP

Splunk SPL 95%

Suricata Rules 92%

EDR Containment 94%

Sysmon Analysis 91%

Ransomware Drill 96%

verified_user

SOC Incident Drills

8 SIEM / EDR Scenarios

SIEM / EDR DRILLS

[LAB 01] Splunk Drill: Pass-the-Hash Detection

150 XP

[LAB 02] Live Red-vs-Blue Ransomware Quarantine

220 XP

[LAB 03] Automated EDR Script Isolation Trigger

250 XP

+5 Automated Ingestion Pipelines Deploy Range open_in_new

TRK-06 // ACTIVE SECTOR Deep Tech Wing 8 Guided Labs STANDARDS: INTEL x86_64 // REVERSE

Malware Analysis & Reverse Engineering

Static & dynamic Portable Executable dissection, Ghidra decompilation, x64dbg tracing, and YARA signature writing.

rocket_launch Deploy Sector Range ()

menu_book

Curriculum Phases & Guided Labs

Binary disassembly, dynamic tracing & anti-analysis evasion

4 Modules • 8 Labs

01

PE Headers, Packing Detection & Static Triage

WEEK 10

Analyzing Import/Export Address Tables, detecting UPX packing, and extracting embedded resources with PEStudio.

Ghidra x64dbg PEStudio

02

Ghidra Decompilation & Control Flow Graphing

WEEK 11

Tracing function pointers, reconstructing obfuscated strings, and decoding XOR payload decryptors.

Ghidra IDA Free Cutter

03

Dynamic Debugging with x64dbg & Anti-VM Bypass

WEEK 12

Setting conditional breakpoints, inspecting CPU flags, bypassing IsDebuggerPresent, and writing defensive YARA rules.

YARA Process Hacker ScyllaHide

radar

Sector Capability Radar

TRK-06 Domain Metrics

ACTIVE SWEEP

PE Triage 95%

Ghidra Decompile 94%

x64dbg Trace 92%

YARA Authoring 91%

Anti-VM Bypass 89%

bug_report

Sample Detonations

8 Sandboxed Binary Labs

DETONATION BOX

[LAB 01] Reverse Engineering Packed Ransomware

180 XP

[LAB 02] Bypassing Anti-Analysis Sleep Loops in x64dbg

200 XP

[LAB 03] Authoring High-Fidelity YARA Rules

DETECTED 240XP

+5 Live Sandboxed PE Detonation Targets Deploy Range open_in_new

TRK-01 // Offensive Wing 8 Guided Labs

terminal

Vulnerability Assessment & Penetration Testing (VAPT)

Web vulnerability exploitation, lateral network tunneling, memory corruption foundations, and active defense bypass.

Burp Suite ProMetasploitNmapChiselBloodHound

STANDARDS: PTES & MITRE ATT&CK

TRK-02 // Defensive Wing 7 Guided Labs

manage_search

Digital Forensics & Incident Investigation (DFIR)

Volatile memory reconstruction, cryptographic image acquisition, forensic timeline assembly, and deep packet carving.

Volatility 3AutopsyFTK ImagerWiresharkEric Zimmerman

STANDARDS: NIST SP 800-86

TRK-03 // Cloud & Infra 8 Guided Labs

cloud_sync

Cloud Security Architecture & IAM Hardening

AWS/Azure misconfiguration exploitation, least-privilege IAM enforcement, and Kubernetes container breakouts.

AWS IAMCloudSploitDockerKubernetesPacu

STANDARDS: CIS AWS BENCHMARK

TRK-04 // Intelligence Wing 6 Guided Labs

radar

Open-Source Intelligence (OSINT) & Threat Recon

Automated entity graphing, dark web indexing, IoT reconnaissance, and enterprise digital footprints.

Shodan CLIMaltegoCensysSpiderfoottheHarvester

STANDARDS: LEGAL RECON DOCTRINE

TRK-05 // Blue Team Defense 8 Guided Labs

shield_with_heart

Incident Response & SOC Operations

Enterprise SIEM analysis, Sysmon behavioral detection engineering, and real-time ransomware quarantine drill.

Splunk SIEMSuricata IDSElasticSysmonWazuh

STANDARDS: SIEM / EDR PLAYBOOKS

TRK-06 // Deep Tech Wing 8 Guided Labs

memory

Malware Analysis & Reverse Engineering

Static & dynamic Portable Executable dissection, Ghidra decompilation, x64dbg tracing, and YARA signature writing.

Ghidrax64dbgPEStudioYARAProcess Hacker

STANDARDS: INTEL x86_64 // REVERSE

developer_board

Dedicated VM

Personal Kali Attack Range

Dedicated Debian instance pre-provisioned with 600+ tools, public IP, and low-latency browser VNC shell access.

Cloud Specs: 4 vCPU / 16GB RAM

hub

VLAN Range

Enterprise Subnet Targets

Active Directory domain trees, unpatched Linux web clusters, SCADA mimics, and Kubernetes pods.

Subnet Space: 45+ Targets Live

policy

NIST & MITRE

Standardized Frameworks

Curriculum mapped directly against MITRE ATT&CK, NIST SP 800-86 forensics, and PTES methodologies.

Standard: ISO/IEC 27001

verified

Tamper-Proof

Accreditation & Seal

Government-recognized, verifiable Council credential with QR verification and permanent registry hash.

Verification: Public Ledger

Cohort Batch 2.0 Admissions Live

All 6 Specializations & 45+ Guided Labs

Includes personal Kali Cloud VM, 90-day sovereign hypervisor access, live weekend mentor triage, and council-issued tamper-proof credential accreditation.

✓ 6 Complete Tracks ✓ 45 Guided Targets ✓ Dedicated Range VM ✓ ISO Council Seal

ONE-TIME

Full 6-week curriculum + 90-day range

Enroll in Cohort 2.0 arrow_forward