Cybersecurity Master Annual Program 2025

Students will recognize and disable unnecessary services, implement secure service accounts, rights, permissions and privileges:

a) Defining and disabling unnecessary services
b) Implementing rights, permissions and privileges
c) Code signing
d) Implementing secure service accounts

Students will understand modern identity attack techniques, including the Pass-the-Hash, Pass-the-Ticket, Kerberoasting and others. Further, they will learn what can be done to mitigate the threat from such attacks and how to do it.

a) Modern Identity Attack Techniques
b) Preventing Credential Theft and Misuse
c) Recommended AD Configuration Options
d) OS-Level Credential Protection Features: LSA Protected Process, Credential Guard, and RDP Restricted Admin Mode
e) Detecting Backdoors in Active Directory

a) Azure&O365 cloud security challenges
b) Zero Trust principles and architecture
c) Incident response management process
d) Cyber kill chain process
e) Hunting through attack chain
f) Azure monitor
g) Azure incident response – best practices

During this module, students will become familiar with detecting and hunting for malware activities.

1. Intro to malware and malware functionalities
2. Hunting for malware C&C communication in network activities
3. Hunting for malware behavior in Sysmon logs
4. Creating a Yara rule for malware family or a suspicious functionality

Students will understand and be able to implement and manage On-Prem and Cloud-service Privileged Access Workstations.

a) Privileged Access Workstations – how and why?
b) Different hardware and VM solutions for implementing PAWs
c) Difference between normal and privileged access
d) Implementing and Managing On-prem PAWs
e) Implementing and Managing Cloud-service PAWs

Students will be able to utilize specific PowerShell tools related to security, such as DSInternals. They will learn advanced PowerShell features which will allow them to audit Active Directory for vulnerabilities.

a) PowerShell security and specific hacktools (like DSlnternals)
b) Advanced PowerShell course
c) Auditing Active Directory using PowerShell

Students will be able to implement, manage and troubleshoot AppLocker.

a) Whitelisting in General
b) Implementing AppLocker
c) Managing AppLocker
d) Troubleshooting AppLocker

a) Managing identity and access in Microsoft Entra ID
b) Network security
c) Microsoft Purview data protection
d) Microsoft Defender for Cloud
e) Application security

Students will understand SQL Server Security baseline and will be able to effectively manage logins and passwords for MS SQL servers.

a) SQL Server Security Baseline Concepts
b) SQL Server Instance Security
c) Managing Logins & Passwords

a) Navigating execution policies: picking the right security strategy
b) PowerShell language modes: locking down your scripts
c) Fortify your scripts: the power of digital signatures
d) Restricting execution permissions: enforcing least privilege for scripts
e) Protecting sensitive information: secure secrets management in PowerShell
f) AMSI: Defending against malicious code with PowerShell
g) Comprehensive logging: auditing and monitoring your PowerShell scripts

a) Introduction to threat hunting and AI in cybersecurity
b) Leveraging AI to detect anomalies and threats
c) Automating threat hunting with machine learning
d) Using AI-powered tools for real-time threat detection

Students will become familiar with threat intelligence and modeling. Further, they will learn how to use open-source intelligence tools and techniques. During this module CQURE Experts will present different patterns attacks.

a) Threat Intelligence, Assessment and Threat Modeling
b) Open-Source Intelligence Tools and Techniques
c) Patterns of Attack

a) Microsoft 365 Security from SOC Analyst perspective
b) Microsoft 364 Defender for Endpoint – EDR story
c) Detection and response with Sentinel – Let’s attack Contoso network

a) From zero to domain admin almost always working exploitation techniques and discovery
b) Advanced network penetration testing
c) Bypassing modern security controls
d) Reporting and remediation strategies in penetration testing

a) Intro with Unified Security Operation with Defender XDR, Microsoft Sentinel and Security Copilot in the Defender XDR portal
b) Configuring and managing Microsoft Defender XDR and integration with Defender Family
c) Configuring and managing Microsoft Sentinel
d) Configuring and managing Security Copilot
e) Automated investigation and incident response with Microsoft Sentinel, Microsoft Defender XDR and Security Copilot
f) Automatic attack disruption in Microsoft Defender XDR and SOC optimization
g) Threat Hunting through attack chain with Defender XDR

a) Entra ID security settings
b) Entra ID identity protection
c) Entra ID privileged identity management (PIM)
d) Entra ID password protection