The 4-day course is designed for the security audience using Microsoft Sentinel + Sysmon, and with some basic access and knowledge into AI assistants. The focus is on transforming SIEM from reactive alerting into proactive adversary detection and zero-day/misconfiguration exposure engine.It aims to give participants the ability to:

- Understand how to ‘Think like an attacker’
- Detect behavior instead of malware
- Build chained event correlations
- Identify misconfigurations via telemetry
- Use AI to detect anomalies without overfitting
- Turn Microsoft Sentinel into a proactive adversary disruption platform

Potential pre-requisites that can help (not required) - Windows internals basics, KQL familiarity, MITRE ATT&CK knowledge, familiarity with PowerShell.


Proposed Syllabus (Not final – subject to some changes):

Day 1 – Attacker Mindset & Telemetry Foundations
- Why reactive SOC fails

- Offensive Thinking for Defensive Engineering
   - Detection engineering vs alert consumption
   - Kill Chain vs ATT&CK vs Behavioral Graphing
   - Zero-day vs misconfiguration exploitation

- LoTL (“Living off the Land” concept) - LOLBins & Native Abuse
   - Why EDR bypass happens
   - LoTL as Post-exploitation ‘heaven’ for attackers – execution, Credential theft, Persistence, Lateral movement etc.
   - Detection framework for LoTL
 
- Sysmon for Offensive Detection
   - Designing Sysmon Config for detection, reduce noise, behavioral signals etc.


Day 2 – AI for Security + Living-Off-the-Land Detection Engineering
- Understanding AI for Security engineering
   - The potential of AI as an assistant (the move from Tools to Agents)
   - Working with AI assistants (e.g. Claude, Gpt etc.) for Security engineering
   - Best practices working with AI with emphasis on Cyber security (safe & secure)

- Process Behavioral Correlation
  - Why atomic detections fail, different anomaly detections, CLI entropy etc.
  - Context vs. Content – and why both matter
  - Build KQL detections correlating:

- Misconfigurations as an Attack Surface
   - Detecting misconfigurations via SIEM (e.g. binary path writable, High-privileged tokens, Overexposed admin sessions etc.)

- AI-Powered SOC & Proactive Threat Hunting
   - Where AI actually helps in Detection Engineering, and what to avoid(!)


Day 3 - Turning Your Sentinel into a “Zero-Day Detector”
- Sentinel Architecture for Offensive Detection
   - Log ingestion pipeline, relevant logs, Table relationships etc.
   - Map Sysmon + SecurityEvent + SigninLogs into unified detection strategy

- Zero-day detection philosophy e.g. detect behavior, not signatures; spot capability, not malware family; etc.

- Building Correlations for LOTL (e.g. Process + network + registry, Or - Rare account + rare host + rare process, etc.)

- Hunting Playbooks - Threat hunting framework, Hypothesis-driven hunting etc.
- Detection as Code’


Day 4 - Automated Response & AI-Assisted Investigation
- Improving a noisy rule into high-signal detection

- Using Sentinel playbooks, creating automated enrichment flows etc.

- Building a simulated attack and attempt to detect the chain early, Correlate multi-source logs, Identify and propose containment steps

- Building a Proactive SOC Culture
   - From alert handling to adversary disruption
   - Using AI to scale detection engineering


Kurstidspunkt:
Dag 1 (14.09.202): 09.00 - 16.00
Dag 2 (15.09.2026): 09.00 - 16.00
Dag 3 (16.09.2026): 09.00 - 16.00
Dag 4 (17.09.20265): 09.00 - 16.00

NB! Her får du ikke mulighet til å være passiv deltager. Dette blir en aktiv workshop der du, med all den hjelp og bistand du trenger fra dyktige teknikere på området, utfører oppgavene i praksis. Som tidligere høstkurs kan du også jobbe aktivt i din virksomhets miljø(er) for sikre disse bedre.

Dette er et spesiallaget kurs av HackCon av og for det norske sikkerhetsmiljøet og tilpasset norske virksomheter - dette er ikke et kurs du får andre steder. Antall plasser veldig begrenset ettersom dette er en aktiv workshop. Meld deg derfor på allerede nå for å sikre deg plass! Hovedkursholder er Yossi Sassi sammen med flere som er blant de fremste i verden på dette området. 

Vi håper å se deg på høstkurs 2026!

NB! Det er bindende påmelding til kurset. Du kan melde deg av uten kostnad før du får faktura (sendes ut i løpet av mai). Du kan sende en annen fra din organisasjon hvis du må melde forfall.