Infrastructure Defense
Course Description
Every other course on this platform teaches you to break in. This one teaches you to make that work hard.
You will build a small but realistic environment — a domain, a few servers, a firewall, a log collector — then defend it against the exact techniques covered in the offensive track: reconnaissance, credential theft, lateral movement, persistence and exfiltration. Each module ends with an attack replayed against your own defences, so you can see what a control actually stops and what it only slows down.
The course assumes you have already followed the free Penetration Testing course, or that you know the attacker's side well enough to reason about it.
Learning Objectives
By the end of this course, you will be able to:
- Segment a network so that one compromised workstation is not the whole estate
- Harden Windows and Linux systems against the privilege escalation paths attackers actually use
- Collect the handful of logs that matter, instead of everything and nothing
- Write detection rules that fire on attacker behaviour rather than on tool names
- Respond to an incident with a sequence you have rehearsed, not improvised
- Measure your own coverage honestly and report the gaps that remain
Modules
Module 1: Threat Model and Architecture (4h)
- What you are actually protecting, and from whom
- Trust zones, segmentation and choke points
- Administrative tiering: why a domain admin should never touch a workstation
- Reading your estate the way an attacker reads it
- Building the lab used throughout the course
Module 2: Network Defence (5h)
- Firewall policy that expresses an intent, not a history
- Egress filtering, and why it breaks most command and control
- DNS as a control point and as a sensor
- Segmenting flat networks without breaking production
- Detecting scanning and pivoting attempts
Module 3: System Hardening (5h)
- Windows: LSA protection, LAPS, attack surface reduction rules
- Linux: services, sudo policy, kernel and filesystem hardening
- Patching as a process with a measurable delay, not an event
- Secure baselines and how to prove a host still matches one
- Replaying privilege escalation against a hardened host
Module 4: Identity and Credentials (5h)
- Where credentials live in memory, on disk and in scripts
- Authentication hardening: MFA, Kerberos settings, protected users
- Service accounts, delegation and the paths they open
- Secret management for infrastructure and pipelines
- Replaying credential theft and Kerberoasting against your defences
Module 5: Logging and Visibility (4h)
- The events that actually matter, host by host
- Centralising logs without drowning in volume
- Retention, integrity and the legal side of evidence
- Instrumenting the gaps: EDR, network sensors, canaries
- Verifying that an attack you just ran left a usable trace
Module 6: Detection Engineering (4h)
- Behaviour over signature: writing rules that survive a new tool
- Mapping your coverage to attacker techniques
- Tuning: false positives are the reason detections get switched off
- Testing detections deliberately with atomic techniques
- Documenting a rule so the next analyst trusts it
Module 7: Incident Response (3h)
- The first hour: scoping before eradicating
- Containment choices and their business cost
- Eradication, recovery and the risk of leaving a foothold
- Post-incident review that changes something
- Writing the report an executive will read and act on
Tools
| Tool | Purpose |
|---|---|
| Sysmon | Deep Windows telemetry |
| Wazuh | Host monitoring and rules |
| Suricata | Network intrusion detection |
| Zeek | Network traffic visibility |
| Sigma | Portable detection rules |
| Atomic Red Team | Testing your detections |
| Velociraptor | Live response and hunting |
Quick Navigation
📄️ Overview
Harden, monitor and defend real infrastructure: segmentation, hardening, logging, detection engineering and incident response