Chapter 4 of 8 · Threat Hunting 50%

🛰️ Cobalt Strike's Beacon checks in on a timer, and SUNBURST hid its C2 in random DNS names. Both leave a rhythm no payload signature can catch. Can you read it?

Attackers bring no malware: they borrow signed Windows binaries and hide in encrypted traffic. You'll hunt the two things they can't fake, an impossible parent-child in process lineage and a beacon's heartbeat, and catch what every tool missed. 🔍

Premium Chapter

Create a free account to access this chapter and start learning with hands-on labs.

Create Free Account

Ready to track your progress?

Create a free account to save your progress, earn XP, and access 170+ hands-on cybersecurity labs.

Start Learning Free

Course Progress

Track your learning journey

0 /8

0 % Complete

8 Remaining

Course Chapters

No chapters found for this filter

Threat Hunting

🛰️ Cobalt Strike's Beacon checks in on a timer, and SUNBURST hid its C2 in random DNS names. Both leave a rhythm no payload signature can catch. Can you read it?

Premium Chapter

Ready to track your progress?

Course Progress

Course Chapters

Threat hunting foundations

The hunt loop

MITRE ATT&CK hunting

Endpoint and network hunting

Threat intelligence fundamentals

IOCs, feeds and platforms

YARA and Sigma detections

The hunt program