Defending Enterprises – 2026 Edition.

Updated for 2026, our immersive 2-day Defending Enterprises training is the natural counterpart to our popular Hacking Enterprises course.

Not only have several existing topics had major tweaks, but the training includes an entirely new section on Entra ID and Azure cloud-based attacks! You’ll play a SOC analyst in our Microsoft Sentinel cloud-based lab and try to rapidly locate IOA’s and IOC’s from a live enterprise breach executed by the trainers in real time.

Whether you’re new to Kusto Query Language (KQL) or a seasoned pro, there’s plenty for you in the 2-days! Yes, we’re using Microsoft Sentinel, but the underlying threat detection theory, logic, and threat hunting approach is transferable into your own environments, whatever your preferred platform. We look at the top 10+ methods we use in offensive engagements and show how these can be caught, along with numerous other examples and methods that go above and beyond common TTPs! This training goes beyond threat hunting as we peek into the world of detection engineering and the processes involved in converting logic into alerts!

With 14 hands-on exercises, many of which also feature extra time and bonus content, you’ll gain real-world experience in the following areas, and more…

– Introduction to Kusto Query Language (KQL)
– Reviewing popular phishing attacks and living off the land techniques
– Locating C2 traffic and beaconing activity
– Detecting persistent activities
– Digging into credential exploitation (Kerberoasting, Pass-the-Hash, Pass-the-Ticket, DCSync)
– Reviewing Active Directory Certificate Services (AD CS) attacks
– Identifying lateral movement (WinRM, SMB)
– Cloud Attacks (Entra ID Enumeration, Azure IMDS, Authentication Tokens, Conditional Access, App Registrations)