Purple Edge
Get started

Threat Detection & Hunting

intermediate4 labsSubscription

Detection-engineering and threat-hunting: the MITRE ATT&CK framework, authoring Sigma rules, hypothesis-driven hunting in endpoint telemetry, and detecting common red-team TTPs.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    intermediate Hands-on lab Subscription

    MITRE ATT&CK for Defenders

    Map adversary behaviors to MITRE ATT&CK tactics and techniques, and use the matrix to measure and close detection coverage gaps.

    35 min3 tasksThreat Detection & Hunting
  2. 2
    intermediate Hands-on lab Subscription

    Detection Engineering & Sigma Rules

    Author a portable Sigma detection rule, convert it to your SIEM's query language, deploy it, and validate that it actually fires on real telemetry.

    45 min3 tasksThreat Detection & Hunting
  3. 3
    intermediate Hands-on lab Subscription

    Hunting in Endpoint Logs

    Run a hypothesis-driven threat hunt across Sysmon endpoint telemetry to surface LOLBin abuse and anomalous parent-child process chains.

    45 min3 tasksThreat Detection & Hunting
  4. 4
    intermediate Hands-on lab Subscription

    Detecting Common Red-Team TTPs

    Detect a full multi-stage red-team operation — recon to execution to persistence — across endpoint telemetry and produce the technique IDs and IOCs.

    50 min4 tasksThreat Detection & Hunting

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-06-06