Training Resources
Summary
Labs, courses and books for each pillar of the roadmap. Free options first. Prices and content change — check the site before paying.
Networks
| Resource |
Type |
Why |
| Wireshark sample captures & Malware-Traffic-Analysis.net exercises |
Free pcaps |
Real infection traffic with answers |
| Zeek documentation & "Try Zeek" |
Free |
Learn the logs this site relies on |
| Suricata documentation (rules chapter) |
Free |
Write and test your own rules |
| SANS FOR572 |
Paid course |
Advanced network forensics |
Windows internals & Active Directory
| Resource |
Type |
Why |
| Windows Internals, 7th ed. (Yosifovich, Ionescu, Russinovich, Solomon) |
Book |
The reference for processes, memory, security |
| Sysinternals tools + Mark Russinovich talks |
Free |
See internals live |
| Microsoft Learn — Kerberos / NTLM / AD DS docs |
Free |
Authoritative protocol behaviour |
| Orange Cyberdefense / "AD mindmap", The Hacker Recipes |
Free |
Attack paths explained with the underlying mechanism |
| GOAD (Game of Active Directory) |
Free lab |
Vulnerable multi-domain AD lab to practise in |
Programming
| Resource |
Type |
Why |
| Automate the Boring Stuff with Python |
Free online book |
Python fluency fast |
| Black Hat Python, 2nd ed. |
Book |
Security tooling in Python |
| The C Programming Language (K&R) or Effective C |
Book |
C fundamentals |
| pwn.college |
Free |
Linux, C, assembly and low-level security, step by step |
Offensive (lab only)
| Resource |
Type |
Why |
| PortSwigger Web Security Academy |
Free, labs |
Best free web-security course |
| HTB Academy — Penetration Tester path (CPTS) |
Paid |
Full recon → lateral movement flow |
| Hack The Box / TryHackMe machines |
Free + paid |
Practice targets |
| Atomic Red Team |
Free |
Small, safe tests per ATT&CK technique for purple teaming |
Malware analysis & reverse engineering
| Resource |
Type |
Why |
| Malware Unicorn — RE101 / RE102 |
Free workshop |
Windows malware, assembly, debugger, static/dynamic analysis |
| Practical Malware Analysis (Sikorski & Honig) |
Book |
Still the best structured introduction |
| Ghidra, x64dbg, PE-bear, FLARE-VM |
Free tools |
Analysis environment |
| OpenSecurityTraining2 (Architecture 1001: x86-64 assembly) |
Free courses |
Assembly done properly |
DFIR, hunting & detection engineering
| Resource |
Type |
Why |
| CyberDefenders, Blue Team Labs Online |
Free + paid |
Realistic DFIR / hunting cases |
| Splunk BOTS (v1–v3) |
Free datasets |
The data used for queries on this site |
| SigmaHQ rules |
Free |
Detection-as-code examples to learn from |
| The DFIR Report |
Free |
Real intrusions written up with timelines and ATT&CK |
| SANS FOR508 / FOR500 / FOR610 |
Paid courses |
Advanced IR, Windows forensics, malware RE |
Threat intelligence
| Resource |
Why |
| MITRE ATT&CK Groups (e.g. Lazarus G0032, Kimsuky G0094) |
Procedure examples to build emulation plans |
| CISA / FBI joint advisories (#StopRansomware, DPRK advisories) |
Actor TTPs with IOCs and mitigations |
| Vendor blogs: Mandiant/Google, Microsoft Threat Intelligence, Unit 42, AhnLab ASEC, Genians |
Ongoing actor reporting; ASEC and Genians cover Korea-focused activity in depth |
References