Cyber Security Operations Analyst
Associate-level certification aligned to CCSSF Cyber Security Operations Analyst. Covers SOC operations, PCAP analysis, SIEM/log correlation, memory forensics, and OSINT/CTI.
PCAP, Protocol Analysis and SOC Network Triage
Detecting Advanced DNS Tunneling Evasion via Slow-Rate Exfiltration and Multi-Domain Correlation
Reconstructing HTTP Sessions via Multi-Request Correlation, Credential and Object Recovery
Detecting TLS Fingerprint Anomalies via JA3/JA3S Computation and Malware Client Identification
Detecting ICMP Covert Channels via Payload Anomaly Identification and Hidden Data Extraction
Reconstructing FTP Data Exfiltration via Passive Mode Analysis and TCP Stream Extraction
Analyzing Advanced SMTP Exfiltration via MIME Multipart Parsing and Encoded Attachment Recovery
Identifying IRC Botnet C2 via PRIVMSG Command Pattern Analysis and Bot Fingerprinting
Detecting Kerberoasting and AS-REP Roasting via TGS-REQ Analysis and Ticket Extraction
Analyzing WebSocket Data Exfiltration via Frame Demasking, Payload Extraction and Protocol Reconstruction
Extracting Modbus Register Data via ICS/OT Protocol Forensics and Unauthorized Read Detection
Recovering Corrupted PCAP Files via Magic Byte Forensics and Partial Capture Reconstruction
Volatility 3 Advanced Analysis: Symbol Tables, Namespaced Plugins and Cross-Layer Memory Correlation
Simulation
DOCX core metadata forensics
DOCX hidden text forensics
DOCX revision comment forensics
DOCX acrostic steganography
DOCX revision history (track changes)
DOCX extended app properties forensics
XLSX core metadata forensics
XLSX hidden cell forensics (white-on-white)
XLSX named range forensics
XLSX cell comment forensics
XLSX hidden worksheet forensics
XLSX very-hidden worksheet forensics
Shellcode Injection and Execution: NX-Free Environment Exploitation and NOP Sled Delivery
Kubernetes RBAC to S3 Pivot: Pod Service Account Lateral Movement to Cloud Storage
IAM Privilege Escalation Chain: AssumeRole, PassRole and CreatePolicyVersion Abuse Paths
Reconstructing Ransomware Infection Vectors from Multi-Source Log Evidence
C2 Beaconing Detection via Log Interval Analysis and Temporal Correlation
Correlating SQLi, XSS, LFI and RCE Attack Patterns Across Web Server Access Logs
Detecting Malicious Service Persistence via Windows Event 7045 and Systemd Unit Forensics
Detecting DNS Exfiltration Through Entropy-Based Subdomain Anomaly Analysis
Instagram-to-Twitter Persona Pivot: Cross-Platform Handle Correlation and Profile Reconstruction
Logs, SIEM Correlation and Threat Hunting
Correlating Multi-Host Authentication Anomalies to Detect Lateral Movement
Correlating Audit Events Across Linux and Windows Privilege Escalation Transitions
QR code decode
Sigreturn-Oriented Programming: Signal Frame Hijacking for Full CPU Register Control with Minimal Gadgets
Morse Code Decoding: Timing Analysis, Delimiter Identification and Transcription Methodology
Bacon cipher
Zero-width steganography
Brainfuck encoding
NATO phonetic alphabet
Multi-layer encoding chain
QR Code Forensics: Error Correction Analysis and Partially Damaged Payload Reconstruction
Baudot encoding
Leetspeak obfuscation
Azure RBAC Misconfiguration: Subscription-Scope Role Assignments and Service Principal Abuse
AWS Service Control Policy Misconfiguration: Cross-Account Permission Escalation
S3 Bucket Policy Misconfiguration: Public Access, Cross-Account Grants and Transport Gaps
Memory Forensics, Malware Signals and Host Triage
In-Memory Password Recovery: LSASS Analysis, WDigest Extraction and Credential Cache Forensics
Detecting Process Injection: Identifying DLL Injection, Hollowing and Reflective Loading Artifacts
Identifying Log Tampering Through Clearance Events and Sequence Gap Analysis
Advanced Multi-Layer Encoding with Compression: gzip/zlib Layer Identification and Programmatic Decoding
Custom VM Obfuscation Reversal: Dispatcher Loop Analysis and Python Disassembler Construction
Password check
License key generation
Simple Buffer Overflow Without Protections: Return Address Overwrite and Program Flow Redirection
ret2libc on x86-64: GOT-Based libc Leak, ROP Gadget Setup and system("/bin/sh") Invocation
ROP Chain Construction: Gadget Chaining for execve Syscall with Stack Alignment and Bad-Byte Avoidance
Canary Brute-Force on Forking Servers: Byte-by-Byte Enumeration Exploiting fork() Memory Inheritance
OAuth-to-Kubernetes-to-Git OSINT Pivot: Authorization Flow Exploitation Across Infrastructure Services
Corporate OSINT Chain: WHOIS, LDAP and SMTP Correlation for Organizational Intelligence
Social Media-to-Map-to-Stego-to-Chat Pivot: Multi-Modal OSINT Chain Across Four Data Domains
Full Corporate Breach Simulation: Five-Service OSINT Chain from Reconnaissance to Data Exfiltration
OSINT and CTI for SOC Enrichment
Underground Forum-to-Pastebin OSINT Pivot: Alias Correlation and Leaked Document Discovery
Email-to-S3 OSINT Pivot: SMTP Reconnaissance Chaining to Cloud Storage Data Exposure
WHOIS-to-Employee OSINT Chain: Domain Registration Pivoting to Internal Staff Identification
Social-to-Chat OSINT Pivot: Instagram-to-Messaging Platform Identity Correlation
AWS Cognito Unauthenticated Identity Pool Exploitation: Anonymous Credential Escalation
Terraform State Manipulation: Injecting Malicious Resource Definitions via Backend Write Access
AWS CloudFormation Credential Exposure: Extracting Secrets from Stack Templates
AWS Lambda Execution Role Privilege Escalation: Function Invocation for IAM Abuse
AWS Secrets Manager Access Control Weaknesses: Scoping IAM Policies for GetSecretValue
AWS Confused Deputy Attack: Cross-Account Role Assumption Without External ID Enforcement
Reconstructing SMTP Email Sessions and Extracting Attachments from Network Traffic Captures
Parsing FTP Command and Response Traffic with Passive Mode Data Channel Reconstruction
Parsing Telnet IAC Command Sequences and Reconstructing Plaintext Sessions from PCAP
Reconstructing IRC Sessions via Protocol PCAP Analysis and Channel Message Content Recovery
Reconstructing LDAP Directory Queries via PCAP Analysis and Enumeration Pattern Detection
Analyzing WebSocket PCAP Captures via HTTP Upgrade Detection and Frame Payload Extraction
Reconstructing SIP Call Dialogs and Extracting RTP Stream Parameters for VoIP Forensics
Enumerating Local Services via mDNS PCAP Multicast Record Analysis and Host Fingerprinting
Interpreting Modbus/TCP Function Codes and Extracting PLC Register Values from PCAP
CTFFactory Cyber Security Operations Analyst — Associate
Associate credential — awarded upon completion