Workshop

Advanced Detection Engineering in the Enterprise

March 10th, 11th & 12th, 2025

– SOLD OUT –

3 days training, by Olaf Hartong & James Gratchoff
This training will be given in ENGLISH

Normal price: CHF 3000.-
Student price: CHF 2250.- (limited availability)

Description

Your organization’s recent red teaming exercise revealed critical gaps in detecting advancedattacks, which bypassed the out-of-the-box detections. Now, it’s time to transform those insightsinto action by developing robust detections.We will make you comfortable with our Detection Engineering methodology, providing hands-onexperience in how to research and analyze attacker techniques, craft resilient analytics andvalidate detections.The training is highly interactive and retains a good balance between theory and a lot of handsonexercises. You will simulate real-world attacks, gaining practical skills to build and maintainadvanced detections.From endpoints to Active Directory to cloud environments, we cover realistic enterprise attackscenarios, preparing you to implement these practices at your organization.By the end of this training, you’ll be equipped to enhance your defenses, anticipate attackerbehavior, and secure your network against evolving threats.

About the trainer

Olaf Hartong is a Defensive Specialist and security researcher at FalconForce. He specialises in understanding the attacker tradecraft and thereby improving detection. He has a varied background in blue and purple team operations, network engineering, and security transformation projects.

James is a seasoned red team operator with over 8 years of experience in TIBER red teaming, penetration testing, and hardware hacking. He has extensive expertise in conducting adversarial simulations and TIBER(-EU) exercises while also testing physical security systems. James uniquely combines his red team duties with designing custom conference badges.

Course outline

Detection Engineering Methodology

  • Introduction
  • Detection Engineering principles
  • Testing, Maintenance and Improvement
  • Automatic deployment and validation

Endpoint

  • Command and Control use and detection
  • Credential Dumping
  • Lateral Movement

Active Directory and server-side attacks

  • Kerberos attacks
  • Active Directory Certificate Services

Cloud Infrastructure

  • Initial access via devicecode phishing
  • EntraID abuse and misconfigurations
  • Azure KeyVault and Storage Accounts
  • Azure Virtual Machine attacks
  • Lateral movement to on-premise

Detection Validation and automation

  • Logic Apps
  • Enrichment pipelines

Course requirements

Students should be familiar with Windows endpoints, Active Directory and Azure cloud.Furthermore, at least some experience Azure Sentinel and its query language (Kusto) isrequired. Recommended study material to prepare will be supplied to the students severalweeks in advance.To connect to our student lab environment, students should be able to use Microsoft RDP(Remote Desktop Protocol) via the Internet on port 3389 TCP.

Organized by

Sponsors

Technology partners

Partner events

Scroll to Top