A hands-on detection engineering course for practitioners who already work in security. You’ll simulate real attacker techniques in a live Windows Active Directory lab, trace them through the telemetry they leave in Windows Event Logs, Sysmon, and EDR, and close every cycle by writing, tuning, and validating a detection rule yourself. This isn’t about learning to recognize an attack. It’s about building the muscle to own the detection that catches it, the same loop a working detection engineer runs in production.
14:30+ hours
on-demand video
Assignments
In class assignments
147
Articles & lessons
10+
downloadable resources
Cross-device
Access on mobile & TV
Certification
Certificate of completion
A hands-on detection engineering course for practitioners who already work in security. You’ll simulate real attacker techniques in a live Windows Active Directory lab, trace them through the telemetry they leave in Windows Event Logs, Sysmon, and EDR, and close every cycle by writing, tuning, and validating a detection rule yourself. This isn’t about learning to recognize an attack. It’s about building the muscle to own the detection that catches it, the same loop a working detection engineer runs in production.
The loop real detection engineers run in production.
Every attack-and-defense module in this course follows the same five-step cycle. It’s the single most important habit the course teaches, because it’s how real detection engineering work is done:
This isn’t a course about recognizing attacks. It’s a course about owning the detections that stop them.
Our trainers are seasoned industry-insiders with a deep, practical understanding of cybersecurity research and development
Uriel Kosayev is a cybersecurity researcher and reverse engineer with over a decade of experience spanning offensive security, malware analysis, and incident response. He co-founded TrainSec Academy and authored two books: Antivirus Bypass Techniques (8,000+ copies sold) and MAoS – Malware Analysis on Steroids (2025). He has contributed vulnerability research to the MITRE ATT&CK framework and published academic white papers on malware detection and memory-based threats.
What makes Uriel’s teaching distinct for this course is that he has actually run both halves of the loop it teaches. As a red teamer, he knows exactly what an attack technique looks like from the inside, what it needs to succeed, and how it tries to stay invisible. As an incident responder and detection researcher, he knows what that same technique leaves behind in the logs, and how to turn that trace into a rule that holds up under real-world noise. This course is that dual background turned into a curriculum: simulate the attack, then build the detection, from someone who has done both professionally.
An orientation to how a EDR, XDR and SIEM correlates telemetry from every source into a single attack picture, and the five-step methodology (simulate, investigate, detect, tune, validate) this entire course is built around.
Builds the offensive vocabulary and mental models, hacker types, the CIA and DAD triads, the Cyber Kill Chain, and threat actor taxonomy, that every later module assumes you already have, using real incident case studies like Kaseya, Colonial Pipeline, and WannaCry.
Walks through reconnaissance, port mapping, AV/EDR bypass reasoning, phishing infrastructure, and SSL stripping from the attacker’s perspective, so you know exactly what footprint each technique leaves for a defender to catch.
Covers malware classification and sandbox evasion, and how to read the MITRE ATT&CK framework properly, then puts it into practice by reconstructing the Emotet infection chain stage by stage.
Hands-on hardening and mitigation work, from VLAN hopping and DHCP/ARP spoofing to LSASS credential dumping and DNS zone transfer attacks, each paired with the concrete Windows and Linux controls that stop it.
The full incident response lifecycle, from preparation and volatile evidence acquisition to eradication and lessons learned, plus a hypothesis-driven threat hunting process that goes beyond static IOCs.
Deep dive into Windows Event Viewer and the Security log, reading Event ID 4624 and 4625 field by field to recognize password spraying, log clearing, and attacker-style domain discovery straight from the log data.
Build Sysmon configurations from scratch and write detection rules across every core event type, process creation, DNS queries, registry persistence, image load, and process injection, then learn to reason about how your own rules could be bypassed.
Clarifies what actually separates AV, EDR, XDR, and SIEM, then walks through deploying and hardening Elastic Defend end to end, including anti-tampering and telemetry sanity checks.
The first full simulate-investigate-detect cycles of the course. RDP, PsExec, and WinRM attacks executed against the lab, then correlated across Windows Security events and Elastic Defend telemetry into KQL detection rules you author yourself.
Simulates the domain enumeration an attacker runs immediately after gaining a foothold, nltest, net user /domain, and net.exe, then builds resilient, wildcard-based Elastic rules that don’t overfit to a single parent process.
Covers encoded PowerShell, WMI process creation as an EDR blind spot, and how to pivot on process ancestry to build behavioral rules that survive an attacker swapping their tooling.
Plants and detects the three classic Windows persistence mechanisms, registry Run keys, services, and Startup folder shortcuts, then dumps LSASS credentials via comsvcs.dll and builds the Elastic rules that catch each technique.
Explores the telemetry footprint of process injection techniques like CreateRemoteThread and process hollowing, then shows how to use the Elastic Security AI assistant to draft and validate detection rules without trusting it blindly.
Closes the course with a repeatable alert triage workflow, the tuning philosophy that separates a resilient detection from a brittle one, and independent practice labs with no answer key.
A standalone reference module on the Windows filesystem and registry locations attackers use most, staging directories, Prefetch, shellbags, USB history, turned into detection ideas you can act on immediately.
