• $150

Constructing Defense

  • Closed
  • Course
  • 145 Lessons

Build the Ultimate Cybersecurity Purple Teaming Home Lab

*Lifetime Access*


Welcome To

Constructing Defense

Build - Execute - Query

Build a Lab

Clear and detailed instructions on building a multi-cloud lab on your own hardware or on your self-hosted AWS instance. Including Windows Active Directory, Active Directory Certificate Services, Kubernetes, Azure and AWS!

Execute TTPs

Learn how to use popular open source C2 frameworks and other penetration testing tools in order to generate realistic telemetry in your own lab environment.

Query

Use a log analytics platform / SIEM (Splunk & Sumo Logic supported!) in order to to craft threat detection queries for your activities.

Three Lab Deploy Options

Automated Deploy with Ludus

Use Ludus to quickly deploy the lab with minimal configuration. This option is for folks who do not want to focus on building a lab and want to dive right into the TTPs! Check out the Ludus Overview section for more details.

Fully Manual Setup

Go from downloading a few ISO files to building a multi cloud Purple Teaming lab! This is for folks who enjoy building things from scratch and want to understand how every bit of telemetry is configured.

Deploy In AWS

Use Terraform to deploy a base version of the lab to your own AWS instance and continue onwards to configure and provision the lab.

Important Requirements

Please Read

This lab is built and hosted on your own hardware or in your self-hosted AWS cloud - please check the Q&A section for detailed hardware requirements and trade-offs.

The lab consists of seven (7) virtual machines, however, not all of them need to be powered on at once.

A non Gmail/Hotmail is required for certain services utilized by the course.

The course involves signing up for cloud services (optional), a valid credit card is required for this.

Lab Diagram

MITRE ATT&CK HeatMap

Questions and Answers

Where is the lab hosted?

The lab is hosted either on your own hardware ( some kind of hypervisor, or a Ludus host) or in your self-hosted AWS cloud. The on-premises component of the lab consists of seven (7) virtual machines. Not all the machines are required to be powered on at the same time however.

Please note - that at this time, full packet capture is not available if you go with the AWS self-hosted option. However, all the PCAP related materials have associated videos and screenshots so you can still get a feel for what full packet capture offers. I am working on a solution to bring some packet/network level visibility to the AWS hosted option.

What are the hardware requirements for the lab?

This is tough to give a fully accurate answer to as systems handle virtual machine workloads differently.

If you have run 3-4 virtual machines with reasonable specs (4-8 GB of RAM, 60+ GB of disk) and an internet connection, you should be able to build the lab and complete the exercises.

What are the prerequisites for the course?

The course includes step by step screenshots and videos for every module. The only real prerequisite is that you are comfortable working with virtual machines ( installing an operating system on some kind of hypervisor from an ISO file )

Can I complete this course if I don't have the hardware for the lab?

The course fee includes lifetime access so you can review the material and watch the videos without actually building the lab and performing the exercises and still get value out of the course.

What SIEM is used for the course?

We will be using a free trial of Sumo Logic which combined with the auditing and the telemetry policies of the lab provides enough ingestion quota for Azure, AWS and on premises telemetry like Sysmon and other Windows and Linux events.

How long do I have lab and course access for?

There is no expiry date for course access, you have access forever / indefinitely. The course will be updated based on feedback and to generally keep up with new techniques / tactics!

Why aren't the labs hosted or built in the cloud ?

There are many tools and projects out there that help you build labs in the cloud in an automated fashion. These are really wonderful projects that this course does not compete with. It just takes a different approach. The goal of this course is to show how each and every bit of telemetry gets configured and ingested. In addition, all effort is made to minimize costs associated with hosting labs in the cloud.

If you want to build the lab in the most automated way possible, a Ludus deploy version is available. This option will get you up and running quickly.

If you have access to cloud resources, there is nothing stopping you from re-creating the lab in the cloud if you wish!

How many CPEs is this course worth?

Continuing professional education (CPEs) are calculated differently by various providers. However, this course has about 5-6 hours of video content, this metric can be used in calculating CPE submissions.

Do I get a certificate of completion ?

Yes, a certificate of completion is provided.

Are there videos in the course?

Yes, there are about six (6) hours worth of videos in the course. All videos are 4K quality and hosted on YouTube. All videos have an instructor (me) talking and all audio was recorded with a high quality Shure microphone.

Are there cloud costs associated with the course?

If you complete the cloud components of the course within 30 days while the Azure free trail and AWS free tier is in place, then no there will not be any costs. However, if you keep the cloud infrastructure up, some costs may be incurred. As of writing (December 2023) these costs are about 20-30 dollars Canadian per month for both AWS and Azure. This will obviously change if you choose to provision cloud resources beyond those covered in the course.

Constructing defense and the course author take no responsibility for any cloud costs incurred.

Is this a blue / red / purple team course ?

These definitions change depending on who you ask. The course is a mix of all three disciplines. You will be running certain pen test / red team tools and C2 frameworks and you will be querying for the telemetry generated by these executions. However, you will not be crafting phishing emails, bypassing any EDRs or conducting enterprise incident response activities. The course is designed to provide an introduction to many areas in order to give participants a start in that area; a thread to pull on.

There are a lot of sections, how can they all be covered in depth?

Great question! There are a lot of sections in order to get participants in the course familiar with the telemetry from these areas and to set up a testing/lab environment for them.

A good example here is Active Directory Certificate Services (ADCS). There are so many attack paths and tools out there for ADCS but this course only covers one of them. However, after completing one execution, you have the lab setup and necessary telemetry configured to test more and go deeper.

Other areas like credential access we dive deeper into, as there are many variations and strands of telemetry to look at.

Will there be more sections added?

Yes, sections will be added and updated. You have lifetime access to the course materials.

Are there any bulk pricing, student discounts or other pricing accommodations ?

Please get in touch: anton@constructingdefense.com and we can talk!

How long do the labs take to set up?

The set up of the lab is broken down into a few sections: downloading the various ISO files, getting the systems provisioned/stood up, and then finally configuring and collecting the telemetry. Plan to spend at least a few days setting the lab up taking into account the various moving pieces.

I do not feel comfortable signing up for cloud services, can I still take this course?

Yes you can still take the course and just follow along with the sections that cover Azure and AWS.

Was any of the course material generated with artificial intelligence (AI)?

No. Every piece of content for this course was made by a human using the references linked in the relevant section combined with years of hands-on experience. No AI was used to generate any content for the course. In fact, all effort was made to make the videos feel less formal and more conversational to remove the robotic feel of AI.

Can I see a course outline and sample lesson?

Yep! Please check below

Course Overview:

Contents

🚨Important Changes Coming to Constructing Defense - Please Read ⚠️
    Preview

    Welcome to Constructing Defense!

    Welcome & Introduction
      Preview
      Changelog
        Preview

        Lab Overview

        Lab Overview
          General Lab Build Approach

            Lab Construction

            ISO Downloads - Windows Server 2019
              ISO Downloads - Windows 11
                ISO Downloads - Ubuntu
                  ISO Downloads - PCAP

                    Lab Construction - AWS Version

                    Terraform Setup
                      Domain Controller
                        Windows 11 A & V
                          Certer
                            Linux A & Linux V

                              [Splunk] - Lab Construction & Provisioning - Ludus Version

                              [Splunk] - Ludus Overview
                                Preview
                                [Splunk] - Ludus Deploy
                                  [Splunk] - Ludus Post Deploy Setup

                                    Lab Construction & Provisioning - Ludus Version

                                    Ludus Overview
                                      Preview
                                      Ludus Setup
                                        Ludus Post Deploy Setup

                                          Lab Provisioning

                                          Domain Controller
                                            Windows 11 A & V
                                              Certer
                                                Linux A & Linux V
                                                  PCAP
                                                    PCAP - New Malcolm Version
                                                      Cloud Accounts - Azure
                                                        Cloud Accounts - Amazon Web Services (AWS)
                                                          Kubernetes Setup
                                                            Sysmon Setup

                                                              Telemetry Setup & Miscellaneous Lab Configuration

                                                              Section Intro
                                                                Windows Auditing and GPO Setup
                                                                  Disabling Defender
                                                                    Certificate Enrollment
                                                                      Linux Auditd + Laurel
                                                                        Sumo Logic SIEM Account
                                                                          [Sumo Logic] - Windows Event Collection
                                                                            [Sumo Logic] - Linux Event Collection
                                                                              [Legacy] - Kubernetes Monitoring
                                                                                [Sumo Logic] - Kubernetes Monitoring
                                                                                  [Sumo Logic] - Cloud Collection - AWS
                                                                                    [Sumo Logic] - Cloud Collection - Azure
                                                                                      [Splunk] - Splunk Setup
                                                                                        [Splunk] - Forwarder Setup (Windows)
                                                                                          [Splunk] - Forwarder Setup (Linux)
                                                                                            [Splunk] - Kubernetes Monitoring
                                                                                              [Splunk] - Cloud Collection - AWS
                                                                                                [Splunk] - Cloud Collection - Azure/Entra

                                                                                                  Lab Executions

                                                                                                  Section Intro
                                                                                                    Getting to Know Ourselves
                                                                                                      Our First Shell
                                                                                                        First Shell - Detection 1
                                                                                                          First Shell - Detection 2
                                                                                                            Our Second Shell - Exploring the Network Layer
                                                                                                              Second Shell - Bonus Round
                                                                                                                Credential Access on Windows Hosts - LSASS
                                                                                                                  Credential Access on Windows Hosts - File Shares
                                                                                                                    Preview
                                                                                                                    Credential Access on Windows Hosts - Kerberoasting
                                                                                                                      Credential Access on Windows Hosts - DCSync
                                                                                                                        Lateral Movement in Windows Environments - WMIExec
                                                                                                                          Lateral Movement in Windows Environments - PSExec
                                                                                                                            Discovery/Recon Detection on Windows Hosts
                                                                                                                              Preview
                                                                                                                              Profiling Rundll32 Executions on Windows Hosts
                                                                                                                                LOLBAS / LOLBINs
                                                                                                                                  Active Directory Certificate Services
                                                                                                                                    Authentication Anomalies on Windows Hosts - The Classic Brute Force
                                                                                                                                      Preview
                                                                                                                                      Authentication Anomalies on Windows Hosts - The Kerberos Approach
                                                                                                                                        Credential Access on Linux Hosts - The Shadow File
                                                                                                                                          Credential Access on Linux Hosts - Through a C2 Framework
                                                                                                                                            Lateral Movement on Linux Hosts - Interactive Bash Prompts
                                                                                                                                              Web Shell Detections on Linux Hosts
                                                                                                                                                Kubernetes Threat Detection - Dipping our Toes
                                                                                                                                                  Kubernetes Threat Detection - The Host Layer
                                                                                                                                                    Kubernetes Threat Detection - The Host Layer - Enumeration
                                                                                                                                                      Kubernetes Threat Detection - Tunneling & Exposed Services
                                                                                                                                                        Kubernetes Goat 🐐
                                                                                                                                                          Kubernetes Threat Detection - Poisoned Pod
                                                                                                                                                            Azure - Password Sprays
                                                                                                                                                              Azure - MFA Madness
                                                                                                                                                                Azure - Wrangling Applications
                                                                                                                                                                  [Legacy] - Azure - Bad to the Bone
                                                                                                                                                                    [Updated] - Azure - Bad to the Bone
                                                                                                                                                                      Azure - AzureHound
                                                                                                                                                                        Azure/Entra Session Hijacking via Browser Cookie Theft 🍪
                                                                                                                                                                          Azure Session Hijack via HAR File
                                                                                                                                                                            AWS - Account Set Up and CLI Access
                                                                                                                                                                              AWS - CloudTrail - IAM User Creation
                                                                                                                                                                                AWS - CloudTrail - IAM User Enumeration
                                                                                                                                                                                  AWS - CloudTrail - Pacu - IAM Brute Force
                                                                                                                                                                                    AWS - CloudTrail - Pacu - S3 Bucket Exfil
                                                                                                                                                                                      Adding a bit of Purple
                                                                                                                                                                                        Endpoint Analysis with Hayabusa and Langchain
                                                                                                                                                                                          Kerberos Attacks & Defenses - Pass the Ticket
                                                                                                                                                                                            Kerberos Attacks & Defenses - Golden Ticket
                                                                                                                                                                                              Web Sockets & .NET Assemblies
                                                                                                                                                                                                DPAPI at the Host and Network Layer
                                                                                                                                                                                                  Purple Teaming Memory Forensics with MemProcFS

                                                                                                                                                                                                    Lab Executions - Splunk

                                                                                                                                                                                                    [Splunk] - Getting to Know Ourselves
                                                                                                                                                                                                      [Splunk] - Our First Shell
                                                                                                                                                                                                        [Splunk] First Shell - Detection 1
                                                                                                                                                                                                          [Splunk] - First Shell - Detection 2
                                                                                                                                                                                                            [Splunk] - Our Second Shell - Exploring the Network Layer
                                                                                                                                                                                                              [Splunk] - Second Shell - Bonus Round
                                                                                                                                                                                                                [Splunk] - Credential Access on Windows Hosts - LSASS
                                                                                                                                                                                                                  [Splunk] - Credential Access on Windows Hosts - File Shares
                                                                                                                                                                                                                    Preview
                                                                                                                                                                                                                    [Splunk] - Credential Access on Windows Hosts - Kerberoasting
                                                                                                                                                                                                                      [Splunk] - Credential Access on Windows Hosts - DCSync
                                                                                                                                                                                                                        [Splunk] - Lateral Movement in Windows Environments - WMIExec
                                                                                                                                                                                                                          [Splunk] - Lateral Movement in Windows Environments - PSExec
                                                                                                                                                                                                                            [Splunk] - Discovery/Recon Detection on Windows Hosts
                                                                                                                                                                                                                              Preview
                                                                                                                                                                                                                              [Splunk] - Profiling Rundll32 Executions on Windows Hosts
                                                                                                                                                                                                                                [Splunk] - LOLBAS / LOLBINs
                                                                                                                                                                                                                                  [Splunk] - Active Directory Certificate Services
                                                                                                                                                                                                                                    [Splunk] - Authentication Anomalies on Windows Hosts - The Classic Brute Force
                                                                                                                                                                                                                                      Preview
                                                                                                                                                                                                                                      [Splunk] - Authentication Anomalies on Windows Hosts - The Kerberos Approach
                                                                                                                                                                                                                                        [Splunk] - Credential Access on Linux Hosts - The Shadow File
                                                                                                                                                                                                                                          [Splunk] - Credential Access on Linux Hosts - Through a C2 Framework
                                                                                                                                                                                                                                            [Splunk] - Lateral Movement on Linux Hosts - Interactive Bash Prompts
                                                                                                                                                                                                                                              [Splunk] - Web Shell Detections on Linux Hosts
                                                                                                                                                                                                                                                [Splunk] - Kubernetes Threat Detection - Dipping our Toes
                                                                                                                                                                                                                                                  [Splunk] - Kubernetes Threat Detection - The Host Layer
                                                                                                                                                                                                                                                    [Splunk] - Kubernetes Threat Detection - The Host Layer - Enumeration
                                                                                                                                                                                                                                                      [Splunk] - Kubernetes Threat Detection - Tunneling & Exposed Services
                                                                                                                                                                                                                                                        [Splunk] - Kubernetes Goat 🐐
                                                                                                                                                                                                                                                          [Splunk] - Kubernetes Threat Detection - Poisoned Pod
                                                                                                                                                                                                                                                            [Splunk] - Azure - Password Sprays
                                                                                                                                                                                                                                                              [Splunk] - Azure - MFA Madness
                                                                                                                                                                                                                                                                [Splunk] - Azure - Wrangling Applications
                                                                                                                                                                                                                                                                  [Legacy] - Azure - Bad to the Bone
                                                                                                                                                                                                                                                                    [Updated] - Azure - Bad to the Bone
                                                                                                                                                                                                                                                                      [Splunk] - Azure - AzureHound
                                                                                                                                                                                                                                                                        [Splunk] - Azure/Entra Session Hijacking via Browser Cookie Theft 🍪
                                                                                                                                                                                                                                                                          [Splunk] - Azure Session Hijack via HAR File
                                                                                                                                                                                                                                                                            [Splunk] - AWS - Account Set Up and CLI Access
                                                                                                                                                                                                                                                                              [Splunk] - AWS - CloudTrail - IAM User Creation
                                                                                                                                                                                                                                                                                [Splunk] - AWS - CloudTrail - IAM User Enumeration
                                                                                                                                                                                                                                                                                  [Splunk] - AWS - CloudTrail - Pacu - IAM Brute Force
                                                                                                                                                                                                                                                                                    [Splunk] - AWS - CloudTrail - Pacu - S3 Bucket Exfil
                                                                                                                                                                                                                                                                                      [Splunk] - Adding a bit of Purple
                                                                                                                                                                                                                                                                                        [Splunk] - Endpoint Analysis with Hayabusa and Langchain
                                                                                                                                                                                                                                                                                          [Splunk] - Kerberos Attacks & Defenses - Pass the Ticket
                                                                                                                                                                                                                                                                                            [Splunk] - Kerberos Attacks & Defenses - Golden Ticket
                                                                                                                                                                                                                                                                                              [Splunk] - Web Sockets & .NET Assemblies
                                                                                                                                                                                                                                                                                                [Splunk] - Purple Teaming Memory Forensics with MemProcFS

                                                                                                                                                                                                                                                                                                  Saying Goodbye 👋

                                                                                                                                                                                                                                                                                                  Outro

                                                                                                                                                                                                                                                                                                    About me

                                                                                                                                                                                                                                                                                                    Hello! I'm Anton Ovrutsky and I currently work in the threat research space. I have spoken at numerous InfoSec conferences and have multiple certifications including OSCE, OSCP, CISSP, CSSP and KCNA - I love all the defensive aspects of cyber security and really enjoy sharing knowledge, queries, detection strategies etc. I love cycling, lifting weights, watching TV on the couch and Drum N' Bass music.

                                                                                                                                                                                                                                                                                                    Constructing Defense