Skip to main content
back to List back
on this page

Crownless Shield – A Deep Dive into Modern Defensive Operations

live online
price $1,400
Mars
Beginner / Intermediate
2 Days
Defense
Wed 9 Dec - Thu 10 Dec
price $1,400
Register


Online, Available in English

Overview

"Crownless Shield" is a practitioner-oriented, two-day deep dive into the full lifecycle of a modern defensive operation, designed specifically for the Middle-East and Africa audience. It is built for the analyst, engineer, or responder who wants a single, coherent curriculum that moves — with hands-on labs at every step — from proactive intelligence gathering, through real-time threat detection across endpoints and networks, into incident response and digital forensics, and finally into practical malware analysis.

The course name reflects its philosophy: the "crown" — the domain-admin account, the flagship application, the executive inbox — is never truly secure on its own. What defends it is the shield of people, processes, tooling, and visibility around it. Over two days, students assemble that shield piece by piece using open-source tools that any organization, regardless of budget, can deploy on Monday morning. Throughout the class, the detection-engineering methodology follows the "Funnel of Fidelity" — Data Collection → Detection → Triage → Investigation → Remediation — and the five-step Detection Engineering process.

By the end of the class, students will have written detection content, operated a SIEM, pivoted through packet captures, triaged endpoint artifacts, analyzed a live memory image, interpreted an application log, and reverse-engineered a real malware sample — all using the same tooling and workflows they will return to in their own SOC or IR team.

Crownless Shield is the course in this series where the regional adaptation is most visible. The technical methodology (Funnel of Fidelity, detection engineering, the IR and DFIR workflow, static / behavioral / manual malware analysis) is universal — but the labs, the example targets, and the capstone are all anchored in Middle-East and Africa threat reality.

MEA-Tailored Labs and Capstone

  • OSINT Lab — the hands-on OSINT investigation is scoped around a simulated MEA-regional target (a fictional regional bank + its external vendors). Students practice Shodan queries, certificate-transparency pivots, paste-site triage, and leaked-credential enrichment against infrastructure topologies that look like real MEA enterprises (heavy on on-prem, regional CDN providers, public cloud used as edge only).
  • Detection Engineering Labs (T1218.005 System Binary Proxy Execution: Mshta; T1003.001 OS Credential Dumping: LSASS Memory) — the worked examples straight out of the source material — are re-framed around the exact tool chain observed in regional incidents: Mimikatz's sekurlsa::logonpasswords (with the three anchor APIs NtQuerySystemInformation / OpenProcess / ReadProcessMemory), Procdump abuse, and SharpDump as a .NET in-memory variant.
  • Network-Threat Detection Labs — the C2 Traffic detection lab uses a packet-capture corpus that mixes classic HTTP / HTTPS beaconing with DNS tunneling patterns seen in-region, plus a MERCURY-style TLS-over-uncommon-port pattern, so students leave with tuned detections for what they will actually encounter.
  • Endpoint Detection Lab — Wazuh + Sysmon is deployed against a representative MEA enterprise endpoint (Arabic / English locale, common regional-enterprise software stack) so that students experience rule-tuning against realistic baseline noise, not against a pristine US English lab image.
  • Malware Analysis Capstone — the real-world sample analyzed in the final 2-hour hands-on is a regionally-relevant wiper-family variant (fully de-weaponized for classroom use). Students perform the full static → behavioral → manual workflow with IDA Pro, OllyDbg, and x32 / x64dbg, and close the loop by proposing detections that feed back into the Day-1 detection-engineering content.

Topics:

  • Analysis of Open-Source Intelligence (OSINT) Application
  • Cybersecurity Threat Detection - Endpoint and Network
  • Threat Detection Engineering and Analysis
  • Network Threats Detection and Analysis
  • Network Threat Detection Operation via Intrusion Prevention System (IPS) (Hands on Labs)  
  • Detect Network Vulnerability Attack (Hands on Labs)
  • Endpoint Threat Detection and Analysis  
  • Introduction to Endpoint Detection Mechanism (Hands on Labs)
  • Build SIEM and endpoint detection with Wazuh (Hands on Labs)
  • Enhanced Endpoint Telemetry Collection – Sysmon (Hands on Labs)
  • Incident Response, Digital Forensics, and Malware Analysis
  • Windows Digital Forensics  
  • Windows Disk Related Artifact Analysis (Hands on Labs)
  • Windows Memory Related Artifact Analysis (Hands on Labs)
  • Windows Event Log Analysis (Hands on Labs)
  • Practical Cybersecurity Incident Response and Digital Forensics
  • Practical Malware Analysis
  • Linux and Other Digital Forensics  

By the end of this course, the participant will learn about: 

  • Articulate the composition, capability requirements, and operational workflow of a modern Blue Team — and position their own role within that structure.
  • Apply the Funnel of Fidelity (Data Collection → Detection → Triage → Investigation → Remediation) and the 5-step Detection Engineering process to any new adversary technique.
  • Use Open-Source Intelligence (OSINT) techniques and public resources to proactively profile attackers, identify exposed assets, and enrich internal telemetry — specifically against MEA-regional target profiles.
  • Explain the roles of SOC, SIEM, and Threat Intelligence in a defensive operation — and how they feed one another in a healthy detection program.
  • Build production-quality detections using Capability Identification and Capability Deconstruction (Tool → Managed-Code wrapper → Windows API → OS primitive), with worked examples on System Binary Proxy Execution (LOLBins) and on Credential Dumping (Mimikatz / Procdump / SharpDump convergence on NtQuerySystemInformation / OpenProcess / ReadProcessMemory).
  • Perform deep network-threat analysis using Wireshark, operate an Intrusion Prevention System (IPS), and detect both vulnerability-exploitation traffic and modern C2 channels — including C2 patterns observed in-region.
  • Build an endpoint-detection stack around Wazuh + Sysmon, including enhanced telemetry collection and tuned rule logic against realistic regional-enterprise baseline noise.
  • Execute the core workflow of an incident-response engagement — from first signal to containment to post-incident reporting — applying triage / investigation / remediation discipline.
  • Conduct digital-forensic analysis across Windows (disk, memory, event logs) and Linux (memory, application logs) using the industry-standard open-source toolchain (FTK Imager, Volatility / Volatility 3, Autopsy / Sleuth Kit, KAPE, plaso / log2timeline).
  • Analyze malware end-to-end using static, behavioral, and manual code-analysis techniques with IDA Pro, OllyDbg, and x32 / x64dbg — culminating in a real-world, regionally-relevant sample analysis.