Certified Blue Team Level 2

BTL2 is aimed at security professionals with 2-4 years experience in a practical role, but can be suitable for individuals with less experience provided they can commit to the intense training. Roles that we believe would benefit from this course include:

• Mid-Senior Security Analysts
• Mid-Senior Incident Responders
• Mid-Senior Security Consultants
• DFIR Specialists
• Threat Hunters
• Malware Analysts

Below are some examples of the skills and experience you will gain.

• Identify, analyze, prioritize, and remediate vulnerabilities to effectively reduce risk.
• Conduct static and dynamic malware analysis to gather indicators of compromise and document details of the malware’s purpose and utilized techniques.
• Conducting adversary emulation activities with the purpose of identifying gaps in SIEM detection rules, creating operational dashboards to identify threats, and hunting on remote systems.
• Perform threat hunts on individual systems and at scale to detect adversaries that have already breached the perimeter.

Domain 1 - Malware Analysis

• Introduction to Malware Analysis

• Build Your Own Analysis Lab

• Static Analysis Tools and Techniques

• Dynamic Analysis Tools and Techniques

• Malware Analysis Practice

Domain 2 - Threat Hunting

• Introduction to Threat Hunting

• Build Your Own Hunting Lab

• Endpoint Threat Hunting

• Network Threat Hunting

• Hunting at Scale

• Hunt Reflection and Report Writing

Domain 3 - Advanced SIEM

• Introduction to Advanced SIEM

• SIEM Architecture

• Proactive SIEM (Hunting)

• Adversary Emulation, Detection, and Analysis

Domain 4 - Vulnerability Management

• Introduction to Vulnerability Management

• Host Discovery

• Vulnerability Discovery

• Analysis, Prioritization, and Threat Intelligence

• Reporting and Remediation

LABS

Below is a list of the BTL2 in-browser labs available as part of the training course:

• Hashing and Strings

• YARA and YarGen

• Monitoring Malicious Processes

• Utilizing Sysinternals For Analysis

• Portable Executable Analysis

• Portable Document Analysis

• Office Document Analysis

• Blackbox Analysis – PE File

• Blackbox Analysis – PDF File

• Blackbox Analysis – Office File

• Windows Program Execution

• Windows System Hunt

• Linux System Hunt

• Hunting With Chainsaw

• Beacon Detection With RITA And Wireshark

• Hunting Empire C2

• Hunting at Scale With Velociraptor

• Creating Deliverables, DeTTECT & Navigator

• Analysis and Hunting (Search & Reporting App)

• Analysis and Hunting (ThreatHunting App)

• Adversary Emulation With CALDERA

• Creating Rules and Dashboards

• Command-and-Control Detection

• Active Discovery With Nmap

• Active Discovery With OpenVAS

• Vulnerability Scanning With OpenVAS

• Vulnerability Scanning With Nikto

• Vulnerability Scanning With WPScan

• Vulnerability Scanning With NSE

PRACTICAL INTRUSION ANALYSIS EXAM

The BTL2 exam is designed to practically assess students on the four domains covered in the training course by utilising a range of tools and techniques to investigate a realistic intrusion scenario. Students have access to the exam lab for up to 72 hours, and must submit their written report, based on a provided template, within this timeframe. The report has pre-built sections for items such as an executive summary, indicator list, malware analysis conducted, and investigation steps per system within the network.

After submitting the report, it is hand-marked by our instructors within 30 working days (but typically much quicker). Students must earn a 70% score or higher to pass, and a 90% score or higher on their first attempt to earn the gold BTL2 challenge coin.

CERTIFIED REWARDS

Once a student passes the practical exam and becomes BTL2 certified for four years, they will receive a number of rewards for their hard work:

• Become Blue Team Level 2 certified for life

• BTL2 Acclaim digital badge

• BTL2 printed certificate

• BTL2 Blue Team Labs Online digital badge

• BTL2 silver challenge coin (gold if score 90%+ on first attempt)

• Laptop Stickers