Skip to content

Threat Detection

Executive Summary

Threat detection focuses on identifying malicious behavior across endpoints, networks, web applications, and security logs.

Topics

  • Windows Attacks and Defense — Common Windows attack techniques and defensive controls.
  • Windows Security Monitoring — Windows telemetry, event IDs, and detection logic.
  • Linux Security Monitoring — Linux logs, authentication events, services, and suspicious behavior.
  • Web Security Monitoring — Web logs, attack patterns, suspicious requests, and application abuse.
  • File Transfer Detection — Suspicious downloads, uploads, User-Agent anomalies, and living-off-the-land file movement.
  • Malware Concepts — Malware types, behaviors, indicators, and analysis basics.
  • Malware Analysis — Static and dynamic analysis methods for understanding suspicious files.
  • JavaScript Deobfuscation — Reading and unpacking obfuscated JavaScript used in attacks.