ACADEMY · CURRICULUM

Cyber Defense & DFIR Curriculum

Seven phases, from reading your first log line to running an intrusion investigation end to end. One estate, one intrusion, followed the whole way — so corroboration is learned the way it is practised. You are assessed on the detections you wrote and the report you would hand an insurer, not a multiple-choice pass.

7Phases

260Hours

100%Defensive

OSSTool stack

Aug ’26Verified

Ask about the next cohort Academy overview

Program at a glance

Phases 1–2 are the shared foundation; 3–7 are the specialist body.

#	Phase	Hours	Level	The question it answers
01	Foundations of Cyber Defense	20	Entry	How are intrusions structured, and which model do I reach for?
02	Telemetry & Detection Engineering	40	Foundation	How do I make an estate produce evidence, then write detections that fire?
03	Digital Forensics: Host & File System	45	Intermediate	What ran, when, and who ran it — provably?
04	Memory Forensics & Malicious Code	30	Advanced	What was happening in RAM that dies at reboot?
05	Incident Response in Practice	55	Advanced	From first alert to closing report, how do I run the whole response?
06	Threat Intelligence & Threat Hunting	30	Intermediate	How do I hunt a hypothesis to a finding, and feed intel back in?
07	Specialised Response	40	Advanced	Ransomware, long-dwell APT, and identity-first attacks that defeat MFA
	Full program	260	—	A defensible end-to-end DFIR practitioner

The seven phases

Each phase adds a slice of the same meridian.local intrusion.

PHASE 01

Foundations of Cyber Defense

Entry20 h

How are intrusions structured, and which model do I reach for when?

1.1The Cyber Kill Chain. Lockheed Martin’s seven phases — and where the model misleads: it is linear and perimeter-shaped, so it under-serves insider, identity and living-off-the-land intrusions.
1.2MITRE ATT&CK (v19.x). Reading a technique for its data sources and — new in v18 — its Detection Strategies; mapping observations to techniques for gap analysis.
1.3Diamond Model & pivoting. Chaining diamonds into a campaign; the reflex ‘what else is true if this is true, and where is it written?’
1.4Where models mislead + IR lifecycle. NIST SP 800-61r3 / CSF 2.0 response functions; TLP 2.0 marking applied to real handling decisions.

Outcome

Place any observation on kill chain and ATT&CK; mark and handle intelligence under TLP 2.0.

Graded lab

An analytic note on a real alert narrative — correct technique IDs and a defensible TLP call.

PHASE 02

Telemetry & Detection Engineering

Foundation40 h

How do I make an estate produce evidence, then write detections that actually fire?

2.1Telemetry & collection. Windows Event channels beyond Security; Sysmon config semantics with a linked known-good config; the difference between what a log captures and what it proves.
2.2EDR as a detection target. Behaviour across the ATT&CK stages; writing and tuning custom rules to a verdict. Wazuh / Velociraptor free stack, commercial EDR as exposure.
2.3Detection engineering. Detection-as-code; the Sigma rule format; measuring a rule’s true/false-positive profile before it ships.
2.4Proving detections fire. Atomic Red Team to generate the exact behaviour a rule targets; the fire / no-fire loop; documenting a detection with its data source and known evasions.

Outcome

Author a Sigma rule against a named technique and demonstrate it firing with a tuned FP rate.

Graded lab

A Sigma rule for rundll32 proxy execution (T1218.011) that fires on the true positive and stays silent on a benign sample.

PHASE 03

Digital Forensics: Host & File System

Intermediate45 h

What ran, when, and who ran it — provably? The Zimmerman / KAPE core.

3.1Acquisition & chain of custody. Order of volatility; defensible imaging; why KAPE’s Jan-2026 commercial-use change means a consulting student needs a free acquisition path.
3.2NTFS internals. $MFT, $SI vs $FN, $UsnJrnl; timestomp tells ($SI/$FN mismatch, round sub-seconds) and file-system tunnelling as a documented false positive.
3.3Execution artifacts. Prefetch (MAM-compressed on Win10+), Amcache (30 MiB SHA-1 caveat), ShimCache (presence, not execution — teach the split), BAM, PCA.
3.4Lateral-movement artifacts. Logon types, 4648 explicit-cred, RDP (1149 = connection not auth; NLA failure → 4625 Type 3), services 7045/4697, shellbags, LNK/jumplists.
3.5Zimmerman tooling & KAPE. EZ Tools 2026.5.0 (GUI = .NET 9 only; CLI dual-runtime); KapeTriage / !EZParser, licence-aware, with a Velociraptor fallback.
3.6Supertimeline construction. plaso (bare log2timeline / psort, --storage-file, no Windows binaries, no bodyfile output); MFTECmd --body; Timeline Explorer.

Outcome

Build a supertimeline and defend a what/when/who conclusion with an independent corroboration chain and a stated confidence.

Graded lab

From a WKS-024 image: which binary ran, at what UTC, under which account — avoiding the ShimCache + Amcache ‘both agree’ trap.

PHASE 04

Memory Forensics & Malicious Code

Advanced30 h

What was happening in RAM that dies at reboot?

4.1Acquisition & Volatility 3 (2.28.x). Symbol tables not profiles; windows.info / pstree / netscan; the plugin renames (malfind → malware.malfind; amcache/hashdump land 2026-09-25).
4.2Injection & hollowing. Private+executable regions, image/path mismatch, unlinked modules — the tell for each and its detection.
4.3C2 config & LSASS. Beacon-config recovery; LSASS access masks worth flagging; credential material and theft artefacts in memory.
4.4Behavioural malware analysis. Safe detonation; capa + YARA for capability tagging; produce a detection, not a write-up.

Outcome

Find injection/hollowing with current plugin names and turn a behavioural analysis into a shippable rule.

Graded lab

In an SRV-APP01 memory image: name the injected process and technique, recover one C2 indicator, emit a YARA/Sigma rule.

PHASE 05

Incident Response in Practice

Advanced55 hCapstone

First alert to closing report — the whole response, on one estate.

5.1Scoping & triage. Pivot entities; noise → signal funnel; severity by impact × velocity; the independence test.
5.2Identity & endpoint containment. Containment that preserves evidence; token/session revocation alongside host isolation, sequenced not to tip the actor.
5.3Investigation & eradication. Timeline-driven, cross-host; find all persistence (services, tasks, WMI, run keys, DLL hijacks) before eradicating.
5.4Evidence & legal defensibility. Chain of custody in practice; UTC discipline — the highest cross-examination risk in the discipline.
5.5Credential theft. Kerberos abuse tells (4768/4769 are requests, success and failure); blast radius from one dumped credential.
5.6Cloud & identity IR. Shared responsibility; M365/Entra and AWS/GCP sources; time and data-source alignment across telemetry.
5.7Closing report. Finding → evidence → confidence → what is still missing; a report that survives an insurer.

Outcome

Lead a scoped response, eradicate all persistence, and write a client-ready report with calibrated confidence language.

Capstone

The full meridian.local intrusion → the closing report, graded on persistence completeness, a UTC-defensible timeline, and ‘consistent with’ vs ‘proves’.

PHASE 06

Threat Intelligence & Threat Hunting

Intermediate30 h

How do I hunt a hypothesis to a finding — never ‘nothing found’?

6.1Threat-intelligence practice. The lifecycle (requirements → dissemination → feedback); PIRs; ATT&CK-driven actor profiling; IOC vs. behaviour value and decay.
6.2Hypothesis-driven hunting. A testable hypothesis from a technique or lead; the hunt loop; ends in a finding, a new detection, or a documented gap.
6.3Finding → detection. Turning a hunt result into a durable Sigma/EQL rule and an ATT&CK-mapped gap report; feeding it back to Phase 2.

Outcome

Run a PIR-driven hypothesis hunt and convert the result into a shipped detection or a documented coverage gap.

Graded lab

Hunt scheduled-task persistence across the estate; deliver the hit with evidence, or a written coverage-gap finding.

PHASE 07

Specialised Response

Advanced40 h

The three cases that break a generalist.

7.1Ransomware. Initial-access-broker → deployment kill chain; the recovery decision (backups, extortion, continuity); what to preserve before rebuilding.
7.2Long-dwell intrusions. When dwell time exceeds log retention: reconstruction from durable artifacts; ‘absence of data is data’; anti-forensics and their own tells.
7.3Identity-first attacks. Golden/Silver tickets, Golden SAML, AiTM/MFA-fatigue, OAuth consent abuse; the identity plane as the battleground.

Outcome

Reconstruct a long-dwell intrusion past its retention window and contain an identity-first attack that defeats MFA.

Graded lab

A long-dwell branch where Security.evtx was cleared: prove the first-access date from durable artifacts and evidence the tampering (System 104 / 1102).

One estate, followed end to end

A single fictional company, meridian.local, is investigated across every phase — initial access via a compromised contractor, lateral movement to the domain controller, service-account abuse, staged exfiltration. Each phase adds a slice of the same intrusion, so students learn corroboration on one coherent story rather than disconnected puzzles.

DC01SRV-FILE01SRV-APP01SRV-JMP01WKS-014WKS-024svc-backupm.reyes

Defensive throughout. Adversary technique is taught from the defender’s chair — what an attack looks like in the artifacts and how you catch it — never as a build-and-deploy guide. Chain-of-custody and legal defensibility are practised inside acquisition (Phase 3) and reporting (Phase 5), where they belong.

Verified tooling baseline

Re-checked against primary sources, 22 August 2026.

Tool	Version / status	What a student must know
MITRE ATT&CK	v19.2	v18 added Detection Strategies; anchor mappings to v19.x
Eric Zimmerman EZ Tools	2026.5.0	GUI tools are .NET 9 Desktop Runtime only; CLI dual-runtime; run on Linux
KAPE	licence changed	No commercial use since 2026-01-01; free for gov/edu/research/internal — teach a free fallback
Volatility 3	2.28.x	Symbol tables not profiles; plugin renames land 2026-09-25
Velociraptor	0.77.1	Free at-scale collection — the KAPE fallback
Hayabusa	3.10.0	Fast EVTX → Sigma triage; pairs with Chainsaw
plaso / log2timeline	current	Bare commands, --storage-file, Docker-first, no Windows binaries, no bodyfile output
NIST IR standard	SP 800-61r3	CSF 2.0 functions supersede the r2 four-phase lifecycle
TLP	2.0	CLEAR / GREEN / AMBER / AMBER+STRICT / RED — WHITE was renamed CLEAR

✓ 9 framework & tooling claims verified and recorded in the Academy verification ledger

Sources

MITRE ATT&CK versions · NIST SP 800-61r3 · FIRST TLP 2.0 · Eric Zimmerman’s Tools · KAPE licence · Volatility 3 · Velociraptor · Hayabusa

All technical claims re-verified against these primary sources on 22 August 2026 and recorded in the Academy verification ledger. Registry paths, event IDs, tool flags and version-dependent behaviour drift — re-verified before each cohort.