← All courses
$20

Threat Tradecraft: Detecting Today's TTPs

Threat-informed defense for practitioners: learn today's attacker tactics, techniques, and procedures — mapped to MITRE ATT&CK — and turn each one into a detection. Cover identity & cloud intrusions, AI-era tradecraft, endpoint living-off-the-land & EDR evasion, lateral movement & C2, and ransomware/extortion. Build a reusable TTP detection playbook. For SOC analysts, threat hunters, and detection engineers. Defensive throughout.

"We stopped chasing indicators and started detecting tradecraft: an ATT&CK-mapped TTP playbook — behavior, telemetry, detection logic, and response — that we validate and keep current"

6 Interactive Sessions

Short, interactive sessions: watch it work, try it, then build it yourself. You can go deeper at any time in the written chapters.

  1. 1

    Catch how attackers work, not just what they leave behind

    Attackers can change their addresses and files in minutes, but changing how they work is slow and costly. So the most valuable detections look for behavior.

  2. 2

    When the attack starts with a login

    Most attackers today do not break in. They sign in. So the earliest warnings are in your sign-in, cloud and email records.

  3. 3

    When a perfect email can still be fake

    AI lets attackers write flawless, personal messages at scale, so spelling mistakes no longer give them away. Defenders now look at behavior, relationships and verification instead.

  4. 4

    When attackers use the tools already on the computer

    Many attackers now avoid bringing their own malware. They misuse trusted built-in tools and run in memory, so the order programs start in and the commands they run become your sharpest detections.

  5. 5

    How one break-in spreads through the network

    Between the first break-in and the damage, attackers look around, move to other computers and call home. Those steps leave patterns, and catching them stops the attack before the end.

  6. 6

    Ransomware: catch it before the ransom note

    The final stage, stealing data, deleting backups and locking files, is loud and late. Catching the steps before it is what saves the company, and a playbook you keep up to date keeps you ready.

Skills you'll practise

ATT&CK-Mapped DetectionThreat-Informed DefensePyramid of PainBehavior over IndicatorsTelemetry-to-Analytic PipelineDetection Validation Loop

Practice data included

  • TTP detection playbook template
  • ATT&CK technique-to-detection mapping
  • Detection data-source guide
  • Assume-breach response runbook

How this certificate is scored

Your certificate shows how many of your written answers met the rubric below, checked by an AI grader. Anyone who checks your certificate sees it.

  • You answer 6 short questions, one for each module, in your own words (at least 40 words each).
  • An AI grader checks each answer against what its module asks for: it must answer the question, use the course's practice case specifically, and be correct.
  • To pass, at least 5 of the 6 answers must meet that bar. The certificate says the answers were graded by AI.

The rubric

  1. Module 1, The ATT&CK-Driven Mindset: The pyramid of pain, ATT&CK as shared language, and the TTP detection-playbook method.
  2. Module 2, Initial Access & Identity: Detections for MFA fatigue, AiTM/session theft, OAuth abuse, and valid-account misuse.
  3. Module 3, AI-Era Tradecraft: Behavioral detections for AI-assisted phishing, deepfake pretexting, and agent/RAG prompt injection.
  4. Module 4, Execution, Persistence & Defense Evasion: Process/command-line + driver-load detections for LOLBins, injection, and EDR evasion.
  5. Module 5, Discovery, Lateral Movement & C2: Detections for credential access, lateral movement, cloud pivots, and beaconing/C2.
  6. Module 6, Impact — Ransomware, Extortion & the Living Playbook: Ransomware/exfil detections plus the assembled playbook, runbooks, and keep-it-current loop.

What you walk away with

Shareable portfolio

A public URL showing your module timeline, patterns mastered, and completion status.

Everything you build

Download all your work as a ZIP file. It is yours to keep.

Module walkthrough

Each module documented with deliverables and the production pattern you implemented.

Ready to start Threat Tradecraft: Detecting Today's TTPs?

First course free. $20 per course after that.