GIAC Certified Incident Handler

Attackers learn the network before they touch it. You perform and read network scans, identify the services and weaknesses they reveal, and set up detection and defenses that make scanning noisy and less useful.

• Host discovery and port scanning techniques
• Service and operating system fingerprinting
• Reading Nmap output for what an attacker learns
• Detecting scans in logs and sensor data
• Reducing exposed services
• Scan evasion and what it changes for defenders

You build A scan of a lab network with a matching detection rule and a list of services to close.

SMB is central to Windows networks, and attackers know it. You learn how shares and sessions work, how weak configuration and credential relay get abused, and how to spot and stop that activity.

• SMB shares, sessions and permissions
• Enumerating shares and users
• Null sessions and weak configuration
• Credential relay and capture on the local network
• Detecting SMB abuse in logs and traffic
• Hardening SMB and reducing its exposure

You build An SMB hardening plan and detection rules tested against a simulated relay attack.

Credentials are the quickest route across a network. You examine how passwords are hashed, how guessing, spraying and cracking succeed, and how to defend and detect with policy, monitoring and multifactor authentication.

• Windows and Linux password hash formats
• Dictionary, rule-based and brute-force cracking
• Password spraying and credential stuffing
• Capturing hashes from the network
• Detecting password attacks in authentication logs
• Policies and multifactor controls that blunt them

You build A hash cracking exercise report with cracked results, root causes and the policy changes that follow.

Web applications face the internet and handle valuable data. You work through injection flaws, insecure direct references and weak API access, see what each looks like in logs, and learn the defenses that fix the cause.

• SQL injection and its variants
• Command injection and file inclusion
• Cross-site scripting and request forgery
• Insecure direct object references
• Improper access to web APIs
• Detecting web attacks in server logs and a WAF
• Developer and operator defenses

You build A set of web log entries from simulated attacks, each with its diagnosis and fix.

Frameworks put exploits and payloads within easy reach. You use Metasploit in a lab to see what an endpoint attack produces on the host and the network, then work out where defenders can detect and stop it.

• Exploits, payloads and handlers in Metasploit
• Client-side attacks and malicious documents
• What Meterpreter does on a host
• Detecting exploitation on endpoints and the network
• Containment steps after an endpoint compromise
• Reducing exposure to common exploit paths

You build A lab compromise and a matching incident write-up with indicators for each stage.

Once inside, an attacker moves. You study how pivoting, port forwarding and tunneling carry traffic through one host to another, how covert channels hide it, and how to find the pattern in network data.

• Pivoting through a compromised host
• Port forwarding and tunneling with common tools
• Netcat and relays
• Covert channels over DNS, ICMP and HTTP
• Lateral movement in Windows environments
• Detecting movement and tunnels in network data

You build A lab network traffic capture with tunnels and lateral movement identified and explained.

A foothold is useful only if it survives. You learn how intruders avoid antivirus and logging, abuse built-in tools and install persistence, and how to hunt for the quiet changes they leave behind.

• Antivirus and endpoint detection evasion at a high level
• Living off the land with built-in tools
• Persistence on Windows: tasks, services, registry, startup
• Persistence on Linux and web servers
• Log tampering and anti-forensic tricks
• A hunting checklist for persistence

You build A persistence hunting checklist and a script that checks one host for each item.

Investigation turns scattered data into a story. You work through network flows and packet captures, host and application logs, and the first steps of malware triage, and you learn where AI assistants help and where they mislead.

• Network evidence: flows, packets and DNS
• Windows and Linux log analysis for intrusion
• Building a timeline from mixed sources
• Basic malware triage: static and dynamic first steps
• Using AI assistance in analysis, with checks
• Writing findings with confidence levels

You build An incident timeline built from logs, a capture and a malware triage note.

Cloud incidents often begin with a leaked key. You see how cloud credentials and stored data are exposed, abused and detected, and how to protect keys, tokens and storage before and after an incident.

• Where cloud credentials leak: code, logs and endpoints
• Abuse of access keys and tokens
• Exposed storage and misconfigured permissions
• Cloud audit logs as incident evidence
• Revoking, rotating and containing in the cloud
• Protecting data stored in the cloud

You build A cloud credential leak scenario with a containment checklist and the audit log queries that confirm scope.

Language models add a new class of incident. You learn how models process prompts, how injection, jailbreaks and data leakage work, and which controls make a deployment harder to abuse.

• How prompts are processed and why instructions blur
• Prompt injection, direct and indirect
• Jailbreaks and policy bypass
• Data leakage and sensitive output
• Detecting misuse of a model deployment
• Defenses: filtering, least privilege, monitoring

You build A set of attack prompts against a lab model, with a defense and detection for each.

Work a full incident in a lab. You detect the first signs, recognize the attacker techniques, contain and eradicate, and write the report that tells management what happened and what changes.

• Reviewing the alerts and early evidence
• Identifying techniques and scope
• Containing and eradicating
• Verifying recovery
• Writing the incident report

You build A complete incident handling record and report for a multi-stage lab intrusion.