SEC599: Defeating Advanced Adversaries - Purple Team Tactics & Kill Chain Defenses
About This Course
SEC599 is an intensive, hands-on course designed to equip security professionals with practical skills for defending against advanced cyber threats. Through more than 20 hands-on labs and a culminating full-day Defend-the-Flag exercise, students learn how to implement effective security controls across the entire attack chain. The course combines real-world attack analysis, adversary emulation, and defensive strategy implementation using industry-standard frameworks like MITRE ATT&CK and Cyber Kill Chain.
From building custom sandboxes to detecting lateral movement and preventing command and control communications, students gain practical experience with modern security tools and techniques. The course emphasizes both prevention and detection, ensuring professionals can both stop attacks and quickly identify when defenses have been breached. It also prepares students for the GDAT certification, validating their expertise in purple team tactics and advanced adversary defense
What You'll Learn
- Leverage MITRE ATT&CK for threat-informed defense
- Deploy custom security controls and sandboxing
- Implement advanced Windows hardening and detection
- Build logging and monitoring with Elastic and Sysmon
- Design threat detection using intel and traffic analysis
- Practice purple teaming with real-world attack scenarios
Entry Requirements
Participants should be proficient in written and spoken English. Please refer to our website for more details on the content taught:
https://www.sans.org/cyber-security-courses/defeating-advanced-adversaries-kill-chain-defenses
There are no minimum entry requirements for years of experience in the domain, education level or age group; but participants should possess the relevant prerequisite skills mentioned above.