Evergreen Alliance Training Program for GIAC Defending Advanced Threats (GDAT)

Active Directory/Domains
You will develop a deep understanding of key concepts related to Active Directory and domains, including the basics of authentication, the Kerberos protocol, common domain attacks, and methods for identifying and mitigating domain-specific threats.

Administrative Access
You will learn about privilege escalation tactics, the risks associated with elevated access, and the critical importance of “least privilege” principles to secure administrative rights and reduce the attack surface.

Adversary Emulation
You will explore adversary emulation techniques, gaining insight into the tools commonly used in these exercises and the essential technical controls to implement when simulating the behaviors of advanced attackers.

Application Exploitation
You will learn how integrating threat modeling with the software development lifecycle, implementing patch management strategies, and applying exploit mitigation techniques can significantly strengthen an organization’s defenses against application-based vulnerabilities.

Data Exfiltration
You will examine various strategies for data exfiltration, the challenges of detecting C2 (Command and Control) channels, and the potential benefits and limitations of deploying deception techniques to disrupt data theft efforts.

Installation
You will review common persistence strategies that adversaries use to maintain access and learn how to protect against these techniques by implementing robust detection and prevention measures.

Lateral Movement
You will analyze different lateral movement techniques used by attackers to expand their reach within a network, and discover defensive strategies and controls to detect and stop the movement of malicious payloads across systems.

Payload Delivery
You will assess different methods for delivering malicious payloads and explore defensive tactics and technologies to reduce the risk of successful delivery, helping to secure endpoints and prevent unauthorized access.

Payload Execution
You will evaluate various techniques for executing payloads within a compromised network, focusing on detection strategies and control mechanisms to block or mitigate the execution of malicious code.

Reconnaissance, Threat Handling, and Incident Response
You will gain expertise in the critical phases of reconnaissance, threat hunting, and incident response, learning how these practices contribute to identifying potential threats early and responding effectively to mitigate damage from adversary activities.