Inside a Cyber Attack.

How Hackers Break Networks and How Defenders Stop Them

What actually happens during a cyber attack? How do attackers get in, what do they do once inside a network, and how do defenders detect and stop them? This bootcamp follows a real attack step by step, from the initial breach to data theft and incident response, then puts you on the defending side.

Methodology

MITRE ATT&CK-aligned
APT-focused campaign & detection

LevelBeginner

Training days

Core modules

100%

Online delivery

Live attack simulation

Build your cyber defence

Cyber attacks are no longer rare events affecting only large technology companies. Companies, hospitals, governments and critical infrastructure can all become a target. This is an operational introduction to how those attacks really happen and how organisations respond.

The attack lifecycle

How an attack unfolds from initial access to exfiltration, as one connected chain.

Red, Blue and SOC

Who does what on each side of an incident, and how the teams work together.

Moving inside a network

Reconnaissance, credential reuse, lateral movement and privilege escalation.

Real attack techniques

Phishing, credential theft and data exfiltration shown as live demonstrations.

How defenders detect

How logs, alerts and monitoring reveal suspicious activity in real time.

Threat hunting

Turning logs into detections, hunting an adversary's footprints across a SIEM.

Two days, both sides of the incident

Day one you follow the attacker. Day two you defend against them.

Day 1 · The attacker's side

Session 1
Red teaming foundations: adversary emulation, the attack lifecycle and MITRE ATT&CK.
Session 2
Reconnaissance to initial access: from Nmap and OSINT to a web shell and a first C2 callback in Havoc.
Session 3
Privilege escalation and persistence: becoming SYSTEM and surviving reboots.
Session 4
Credential theft and impersonation: LSASS dumping, Kerberoasting, Pass-the-Hash and Pass-the-Ticket.
Session 5
Discovery, lateral movement and domain dominance: BloodHound, PsExec/WinRM and DCSync to own the domain.

Day 2 · The defender's response

Session 1
Log analysis foundations: log types, endpoint telemetry and how a SIEM ties it together.
Session 2
Microsoft Sentinel and KQL: querying, filtering and visualising security data.
Session 3
Hunting the intrusion: detecting recon, web shells and suspicious process activity.
Session 4
Catching privilege escalation and credential theft: token manipulation and LSASS access.
Session 5
Tracking the adversary: C2 over web protocols, scheduled-task persistence and Pass-the-Hash.