What you'll learn
- Hardening baselines
- EDR and telemetry
- Safe static triage
- Forensics fundamentals
Lessons
1Hardening baselines
Apply CIS Benchmarks or Microsoft security baselines; enable BitLocker/FileVault, application control (WDAC/AppLocker), attack surface reduction rules, LAPS for local admin passwords, and automatic patching.
2EDR and telemetry
EDR records process creation, network connections, registry and file changes. Sysmon (Event IDs 1, 3, 11, 13) gives similar detail for free. Watch for office apps spawning shells, LOLBins (certutil, mshta) and unusual parent-child chains.
3Safe static triage
Never open suspicious files on a work machine. In an isolated analysis VM: compute hashes, check reputation (VirusTotal), read strings, inspect PE headers, and write a YARA rule from unique strings. Infostealers delivered through fake repositories or fake CAPTCHA pages ("ClickFix") were a major 2026 theme.
4Forensics fundamentals
Order of volatility: memory before disk. Preserve chain of custody. Key artifacts: Prefetch, Amcache, ShimCache, event logs, browser history, $MFT timelines.
Hands-on lab: Write a YARA rule for a harmless test file
- In a VM, create
test.txtcontaining a unique string likeSENTINEL_LAB_MARKER_2026. - Install YARA and write a rule matching that string.
- Run
yara rule.yar ./folderand confirm a match. - Download the EICAR antivirus test file and watch your AV detect it.
- Note which Sysmon events appeared during the test.
Outcome: You can build and test detection content safely.
Practice questions
Which should be collected first in forensics?
Answer: Memory (RAM). Memory is most volatile.
Sysmon Event ID 1 records…
Answer: Process creation. Event 1 = process create.
LAPS mitigates…
Answer: Shared local admin passwords. Unique, rotated local admin passwords.
The full graded assessment (4 questions, pass mark 70%) is in the platform.
Key terms
- Hardening
- Reducing attack surface by removing services and applying secure settings.
- Application allow-listing
- Only approved software can run (WDAC, AppLocker).
- LOLBins
- Living-off-the-land binaries: legitimate tools abused by attackers (certutil, mshta).
- Sysmon
- Microsoft tool logging detailed process, network and file activity.
- YARA
- Pattern-matching rules to identify and classify files.
- Sandbox analysis
- Running a sample in an isolated environment to observe behaviour.
- Infostealer
- Malware that harvests browser passwords, cookies and tokens.
See the full cyber security glossary →
Official references
Related courses
Security Operations & Incident Response
SIEM, detection engineering, triage, the IR lifecycle and writing a useful post-incident review.
Threat Intelligence & MITRE ATT&CK
Intelligence lifecycle, ATT&CK mapping, IOCs vs TTPs and turning news into defensive action.
Digital Forensics
Evidence handling, Windows and Linux artifacts, memory forensics and building timelines.