The final week of the 2-month bootcamp. System hardening with CIS Benchmarks, network segmentation, zero-trust principles, threat intelligence and MITRE ATT&CK, malware analysis fundamentals, cloud security misconfigurations, purple team methodology, and the complete graduation capstone tying every skill together.
| DAY | TOPIC | WHAT YOU'LL LEARN | KEY TOOLS |
|---|---|---|---|
| Day 50 | System Hardening | CIS Benchmarks — the gold standard hardening framework. Linux hardening: disabling unnecessary services, SSH configuration (PasswordAuthentication no, PermitRootLogin no, AllowUsers), umask, PAM password policies, auditd, sysctl kernel parameters for network hardening. Windows hardening via Group Policy: LAPS, AppLocker, Windows Defender Credential Guard, PowerShell Constrained Language Mode, disabling legacy protocols (SMBv1, NTLM, WDigest). | CIS-CAT, Lynis, Group Policy, LAPS |
| Day 51 | Network Hardening | Network segmentation with VLANs — why flat networks are catastrophic for lateral movement. Zero-trust architecture principles: never trust, always verify, least-privilege access. Firewall rule ordering and default-deny posture. DNS sinkholing for C2 blocking. Network Access Control (NAC). Monitoring egress not just ingress — most organisations watch the front door but ignore the back. Intrusion prevention mode on Suricata. | iptables, pfSense, VLAN, Suricata IPS |
| Day 52 | Threat Intelligence | MITRE ATT&CK framework in depth — 14 tactics, 200+ techniques, sub-techniques, and procedure examples. IOC (Indicator of Compromise) types: IPs, hashes, domains, mutexes, registry keys. IOA (Indicators of Attack): behavioural patterns. TI feeds: MISP, AlienVault OTX, VirusTotal, Shodan, AbuseIPDB. TTP-based hunting vs IOC-based hunting. Threat actor profiling and attribution. Building a detection gap analysis from ATT&CK Navigator. | MISP, ATT&CK Navigator, OTX, MITRE |
| Day 53 | Malware Analysis Basics | Static analysis: file type identification (file, strings), PE header analysis (sections, imports, exports), packer detection with PEiD/Detect-It-Easy, YARA rule writing. Dynamic analysis: sandbox execution in Any.run/Cuckoo, process creation monitoring (Procmon), network connection monitoring (Wireshark), registry change monitoring (Regshot). Identifying C2 beaconing patterns, persistence mechanisms, and data exfiltration in malware behaviour reports. | strings, Detect-It-Easy, Cuckoo, Any.run, Procmon |
| Day 54 | Cloud Security | AWS security misconfigurations that cause real breaches: public S3 buckets, overprivileged IAM roles, disabled CloudTrail, open security groups (0.0.0.0/0), exposed EC2 metadata endpoint, unencrypted RDS databases. AWS security tools: GuardDuty, Security Hub, CloudTrail, Config, IAM Access Analyzer. Securing Azure and GCP (parallel concepts). ScoutSuite for multi-cloud security auditing. The SSRF-to-metadata credential theft chain from an attacker's perspective (covered in Week 4) — now from the defender's side. | AWS GuardDuty, ScoutSuite, Prowler, CloudTrail |
| Day 55 | Purple Team Exercise | Purple team methodology: structured adversary simulation where red team executes attacks while blue team monitors and validates detections in real time. Building an ATT&CK-mapped test plan. Atomic Red Team — pre-built attack simulations mapped to ATT&CK techniques, executable with one command. Running 10 atomic tests covering initial access through exfiltration. Validating detection coverage: which attacks did the SIEM catch? Which slipped through? Gap analysis drives detection engineering priorities. | Atomic Red Team, ATT&CK Navigator, Splunk |
| Day 56 | Graduation Capstone | Complete 2-month skill consolidation across all 4 phases. Full-spectrum assessment: the combined offensive + defensive skills map. Mock PNPT-style assessment: compromise a target network and write the full professional report. Certification path finalised. Career trajectory options (pentester, SOC analyst, red team, threat intelligence, cloud security, AppSec). What to do in months 3–12. Communities, continuing education, and staying sharp. Bootcamp complete. | All tools across 8 weeks |
THEORYLAB CIS Benchmarks · Linux Hardening · Windows Group Policy · LAPS · Credential Guard
Hardening is defence before the attacker arrives. Every privesc technique you learned in Week 5 — SUID binaries, sudo misconfigs, unquoted service paths, token impersonation — has a hardening countermeasure. Understanding the attack makes the defence obvious. Today you close the doors you spent Phase 3 walking through.
The Center for Internet Security (CIS) publishes detailed, consensus-based hardening guides for every major OS, application, and cloud platform — freely available at cisecurity.org. Each benchmark contains hundreds of specific configuration settings with rationale, remediation steps, and audit commands. CIS Level 1 = sensible baseline. CIS Level 2 = high-security environments.
sekurlsa::logonpasswords and gets empty results. They then run sekurlsa::wdigest — also empty. However, they find they can still Kerberoast service accounts and crack one password. Why does Credential Guard not prevent Kerberoasting?
lynis audit system on your Kali VM. Note your score. Apply 5 hardening recommendations. Run again — measure improvement.THEORYLAB VLANs · Zero Trust · Firewall Rules · DNS Sinkholing · Egress Monitoring
Most organisations focus entirely on perimeter defence — and attackers know it. Once inside (via phishing, VPN credential spray, or supply chain), a flat network means every machine can talk to every other machine. The lateral movement chain from Week 5 only worked because the network had no segmentation. Fix the network, and a beachhead stays a beachhead instead of becoming a domain compromise.
In a flat network, a compromised workstation can directly reach the Domain Controller, file servers, database servers, and every other workstation. The BloodHound attack path from Week 5 — helpdesk PC → workstation → DC — only existed because those systems were all on the same broadcast domain with no firewall between them.
THEORYLAB MITRE ATT&CK · IOCs · IOAs · TI Feeds · ATT&CK Navigator · MISP
Threat intelligence tells you who is attacking, how they operate, and what to look for before they arrive. IOC-based intelligence (block this IP, this hash) is the lowest maturity — it's reactive and easily evaded. TTP-based intelligence (this threat actor uses these techniques) is what separates reactive defenders from proactive hunters who detect attacks at the first technique, not the tenth.
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. Every technique you learned in this bootcamp has a corresponding ATT&CK ID. It's the common language between red teams, blue teams, threat intel, and tool vendors.
| TYPE | WHAT IT IS | EXAMPLE | EVASION DIFFICULTY | MATURITY LEVEL |
|---|---|---|---|---|
| IOC — Hash | MD5/SHA256 of a known malicious file | 5f4dcc3b5aa765d61d8327deb882cf99 | Trivial — recompile, change one byte | Level 1 (Reactive) |
| IOC — IP/Domain | Known C2 server address | 203.0.113.50 / evil-c2.com | Easy — new IP/domain in minutes | Level 1 (Reactive) |
| IOA — Behaviour | Suspicious action pattern regardless of tools | Any process reading lsass.exe memory | Hard — attacker must fundamentally change technique | Level 3 (Proactive) |
| TTP — Technique | ATT&CK-mapped technique with procedure | T1003.001: OS Credential Dumping via LSASS | Very Hard — must completely change attack approach | Level 4 (Strategic) |
| TTP — Actor Profile | Full actor profile: tools, infra, targets, motivations | APT28: spear-phishing → Mimikatz → custom implant | Extremely Hard — requires entire actor to retool | Level 5 (Strategic) |
THEORYLAB Static Analysis · Dynamic Analysis · Sandboxes · Behavioural Indicators · YARA
Malware analysis answers: what does this thing actually do? When incident response finds a suspicious file, you need to know — is it malicious? What does it connect to? What data does it steal? What persistence does it install? You answer these questions through static analysis (inspect without running) and dynamic analysis (run in a controlled environment and observe). You never run suspicious files on production systems.
strings output is almost entirely garbage — short bursts of readable text surrounded by encrypted/compressed data. What does this indicate and what is your next step?
THEORYLAB AWS Misconfigurations · IAM · CloudTrail · GuardDuty · ScoutSuite · Azure/GCP
Cloud misconfigurations have caused more major breaches in the last five years than any other single vulnerability class. Capital One (2019, 100M records), Microsoft Exchange Online (2023), Twitter (2020) — all cloud misconfigs. The attacker's toolset from Week 4 (SSRF → EC2 metadata → IAM credentials → S3 data) is the most common cloud attack chain. Today you learn to defend it.
s3:* on *, (2) IMDSv1 enabled, and (3) a security group allowing 0.0.0.0/0 on port 443. During a pentest you found an SSRF vulnerability in the web app. Describe the complete exploitation chain and prioritise the three misconfigurations by remediation urgency.
TOOLLAB Atomic Red Team · ATT&CK Navigator · Detection Gap Analysis · Attack-Detect-Verify Loop
Purple team is the highest-value security exercise most organisations never run. Red team attacks. Blue team defends. They debrief separately, write reports, and two months later the blue team still doesn't know which of their detections actually fire. Purple team collapses this — red and blue work together in real time: attack a technique → immediately verify whether the SIEM caught it → fix the detection if it didn't → move to the next technique. Every gap closed in real time.
Atomic Red Team (github.com/redcanaryco/atomic-red-team) is a library of small, focused attack simulations mapped to MITRE ATT&CK techniques — one "atomic test" per technique. Run them in your environment to test detections without needing a full red team. Free, open-source, maintained by Red Canary.
After running Atomic tests, colour the ATT&CK Navigator matrix to show your real detection posture. This turns abstract "we have a SIEM" into "we detect 18 of 30 tested techniques across these 6 tactics, with gaps in Defence Evasion and Lateral Movement."
CAPSTONE 2-Month Complete Review · Full-Spectrum Skill Map · Career Paths · What's Next
56 days. 4 phases. Beginner to professional-ready cybersecurity practitioner — both offensive and defensive. Every major attack technique. Every core defensive control. You built a home lab, compromised real machines, wrote detection rules, performed forensics on memory dumps, and hardened systems against your own attacks.
| CAREER PATH | WHAT YOU DO | RELEVANT PHASES | FIRST CERT TARGET | TYPICAL ENTRY SALARY |
|---|---|---|---|---|
| Penetration Tester | Authorised hacking of client systems to find vulnerabilities before attackers do. Web apps, networks, AD, mobile. | Phases 1–3 primarily | eJPT → PNPT → OSCP | $70k–$100k |
| SOC Analyst (L1/L2) | Monitor SIEM alerts, triage incidents, investigate anomalies, escalate confirmed incidents to IR team. | Phase 4 primarily | Security+ → BTL1 | $55k–$80k |
| Red Team Operator | Advanced long-term simulated attacks against mature targets. Custom implants, AD attacks, evasion. Senior role. | Phases 2–3 deeply | PNPT → OSCP → CRTO | $100k–$150k |
| Threat Intelligence Analyst | Track threat actors, map TTPs, produce intelligence reports, brief executives on risk landscape. | Phase 4 Day 52 | Security+ → CEH → GCTI | $75k–$110k |
| Cloud Security Engineer | Secure AWS/Azure/GCP environments. IAM, misconfig remediation, cloud-native detection, CSPM tooling. | Phase 4 Day 54 | AWS Security Specialty → CCSP | $100k–$140k |
| Bug Bounty Hunter | Independent. Find vulnerabilities in companies' public programmes. Web app focused. Income varies wildly. | Phases 2–3 web focus | No cert needed — portfolio matters | $0–$300k+ (highly variable) |
| Detection Engineer | Build and maintain the rules, queries, and logic in the SIEM. Turn ATT&CK techniques into detection coverage. | Phase 4 Days 45, 55 | Security+ → Splunk Core Certified → BTL1 | $85k–$120k |
This is your graduation exam. Give yourself 5 days, as if it were a real client engagement. No walkthroughs. Everything from memory.
What you have now that you didn't have 56 days ago: A mental model of how attackers think. A home lab you can hack and defend. 80+ tools you've actually used. The ability to read a CVE and understand its impact. The vocabulary to communicate risk to both executives and engineers. A foundation that took most security professionals 2–3 years to build through scattered self-study.
What comes next is practice. Do one HackTheBox machine per week. Submit one bug bounty report per month. Read one CISA advisory per week. Build one new detection rule per week. In 6 months, take the PNPT. In 12 months, take the OSCP. In 24 months, you are a professional. The field is yours.