WTH! Weaponized Threat Hunting:

An expletive laden review of the OSDA

I very recently completed the SOC-200 course, and passed the associated OSDA exam, this is my fourth Offsec course (formerly known as offensive security), and my third certification from this vendor under my belt.

In keeping with the tradition of reviewing the courses I’ve completed, I feel it’s appropriate to write a review of the course material, and exam using my coarse language, hopefully to offer insight to others interested in learning about the material, but mostly as a way to blow off some steam.

Be aware in writing this, I am an independent, I have paid for all my courses out of pocket, and am not beholden to an “employer”, “sponsor”, or “political correctness”, I am writing this review to denote both the positive, and negative aspects I experienced during the course, and am 100% ready to call out what I perceive is bullshit, since I have no obligation, desire, or incentive to play nice.

With those pleasantries out of the way, I can now proceed with my review.

OSDA course overview:

The Offsec Defense Analyst course, is described as a SOC operations course, while this description isn’t exactly in-accurate, I would say the actual majority of the course material pertains to low level endpoint specific threat hunting. With only the last two modules pertaining directly to a SEIM which would be used in SOC operations to monitor multiple endpoints, the SEIM in question being Kibana.

To delineate what is meant by “low level endpoint specific threat hunting”, I mean to say that the course consists of teaching the student via powershell scripts, bash/python scripts, and event viewer usage to hunt for logs, and events on an endpoint that are indicative of an attackers anomalous patterns, and indicators of compromise.

Later sections, and the labs, are concerned with reactive, and proactive threat hunting across several collated endpoints using the Kibana SIEM via KQL, and OSQuery language (Lucene is not discussed, or covered). The exam makes exclusive use of this tool, and as such the exam should be considered “tool specific”, and not tool agnostic.

An interesting note about the OSDA, is in theory it can also serve as an “OSCP lite” course in the sense that all the attacks covered in the course can be conducted manually by the student; instead of using the provided “attacker scripts” that automate these attacks for convenience. Students wanting to gain additional insight into how an attacker performs these attacks may actually attempt to manually perform these attacks themselves, and obtain practical low level experience should they wish to do so.

Having said that, this course should not be considered the OSCP equivalent of the blue team world, the SOC-200 is a specialist course covering low level threat hunting, and SOC operations using a SEIM, not the wide gamut of disciplines, or tools required to have a spectrum understanding of most blue team disciplines, such as system forensics, network investigations, malware reverse engineering, IOC identification via hash lookup, system hardening techniques, ect.

The SOC-200 course is a specialist course, and likely the best one currently on the market for the discipline being taught, but it is not a comprehensive blue team course.

Purchasing the course grants the student the following:

• A .pdf file containing material covered in the course.
• A set of course videos containing material covered in the course.
• 3 months worth of access to the course labs, and OSA videos.
• 1 exam voucher to challenge the OSDA exam.
• An OSDA student role on discord, allowing access to private student only boards.

SOC-200 course specific obtainable qualifications:

An individual can obtain the following qualifications by going through the SOC-200 course.

• OSDA certification: This is achieved by sucessfully passing the OSDA exam, passing the exam also grants access to the OSDA certified role on discord, the masters lounge on discord, and the addition of the certification on accredible, this qualification does NOT expire.

• Letter of completion/40 ISC2 credits: By completing 80% of the total course, (across all course subjects), one can request a letter of completion from offsec, this letter is also worth 40 ISC2 CPE credits.

• Security data collection skill pin: This is the only skill pin that can be obtained through the SOC-200 course, to do so one needs to complete 100% of the following course modules:

• Windows endpoint introduction.

• Linux endpoint introduction.

• SIEM Part One: intro to ELK

• 4 partial skill pin contributions: The SOC-200 course modules will also contribute towards the following skill pins:

• Monitoring, Intrusion Detection and Analysis Skill Path [2 OSDA] [2/3 Total]

• Rule Creation and Refinement Skill Path [2 OSDA] [2/3 Total]

• Active Directory Overview Skill Path [1 OSDA] [1/3 Total]

• SOC Analyst Tools Skill Path [1 OSDA] [1/3 Total]

Course modules reviews:

The following is review of each of the 18 individual SOC-200 course modules. I will give a brief overview then conclude with a module specific rating.

1). Introduction to SOC-200: This is section pretains to onboarding for the course, it’s just standard information regarding the course sctructure, and how the material should be approached.

Rating: N/A

2). Attacker Methodology Introduction: This section examines different adversary cases files, and outlines different methodologies used by said attackers, and how one can map these actions using the Lockheed-Martin Cyber Kill-Chain, and the newer MITRE framework.

While the section does a good job illustrating how an attacker may function from the sample case files presented, I feel the explaination of the MITRE framework is mediocre. There are no associated labs to allow a student to get their hands dirty using the MITRE framework, I also felt the explanation of MITRE was serviceable but basic.

In order to get a better understanding of MITRE from a practical standpoint I would suggest the TryHackMe MITRE room, as well as the free MITRE section in the BTL1 introduction course to gain a better understanding of why the MITRE framework uses specific naming conventions of adversaries.

Rating: 3/5

3). Windows Endpoint Introduction: This section lays the groundwork for the majority of the other modules in the course, and the other sections will be dependent on how well the methodologies and concepts are presented here. Fortunately, the authors did a perfect job with this section, explaining why things are they way they are, and how a student can leverage the powershell, and EventViewer tools to gather endpoint information.

The module explains how one can gather endpoint information using the command prompt, VBScript, and powershell, and presents the use cases for each, but ultimately explains that powershell is the method one should use to obtain endpoint information, as it is the most versatile, and has less draw backs than the other older methods. Several powershell scripts are provided to the students that they may leverage for endpoint investigation, an explaination of the use cases for these scripts is concise, and easy to understand.

The module also gives a fantastic overview of Sysmon logs, and the EventViewer tool usage for a GUI based examinination of logs, and event ID’s, including custom EventViewer XML development for tailored analysis.

The last portion discusses remote endpoint access, and analysis using powershell via a kali linux instance.

Rating: 5/5

4). Windows Server Side Attacks: This section covers various different server side attack vectors attackers may use against a Windows endpoint, such as a hydra bruteforce attack, file uploads, and WordPress exploitation, ect. These attacks are executed from a provided script, after doing so the student may then examine the Event ID’s generated by the attacks to understand the indicators of compromise, and understand how an attack looks like from a offensive, and defensive standpoint.

As previously mentioned the attacks may also be performed by the student manually to gain a low level understanding of the attackers tool usage.

This section provides an excellent overview of standard server side attacks, it’s nothing overtly advanced, but an important primer on the most common attack vectors an attacker would leverage against a target.

Rating: 5/5

5). Windows Client-Side Attacks: This section discusses client side attack vectors an adversary may leverage including social engineering, phishing, and spearphishing methods via malicious macro enabled attachments, and how they may be identified from a defense standpoint.

The resulting script block events are explained thoroughly, this section also covers script obfuscation, and deobfuscation. This portion of the module is a standout, as it’s one of the few sections that explains an attacker methodology, tool, and it’s associated usage in more detail than in the PEN-200 course material.

The obfuscation, and deobfuscation tools discussed are very cool and easy to use, this was a magnificent module, and I learned something new from both an offensive, and defensive standpoint, that’s awesome!

Rating: 5/5

6). Windows Privilege Escalation: This section starts by giving an overview of how an attacker may escalate privileges on an endpoint, including common system enumeration tools leveraged to find system vulnerabilites such as accesschk64.exe, PowerUp.ps1 (these aren’t necessarily malicious and can also be utilized by an administrator to perform preemptive system enumeration).

I was a little surprised some common attacker enumeration scripts were not discussed, or even mentioned, such as winpeas, or seatbelt, ect.

The attacker vectors outlined include bypassing UAC via fodhelper.exe, which in the labs is done via a script that makes use of a metasploit fodhelper.exe exploit, this is not a manual explanation of this privilege escalation method.

Other attack vectors discussed include malicious service creation, as well as unquoted service path exploitation, these sections again leverage metasploit to illustrate the attack. Reviewing the written course material, and associated videos helps give one a more low level understanding of these attacks.

The explanation of how to identify indicators of this kind of attack are well done, and the images of what these kind of vulnerabilities look like are integral for a defense analyst to understand, and remember when performing pro-active threat hunting.

This is a strong section, however I feel there was a missed opportunity to discuss other common attacker enumeration tools, as well as a lower level depiction of the attacks, opposed to this reliance on metasploit exploitation.

Rating: 4/5

7). Windows Persistence: Alright, I know I’m going to come off as a heretic, but when I did the PEN-200 course, I did not focus on persistence. As this discipline was not really relevant to the OSCP exam, it wasn’t a priority during my PEN-200 course access, so coming into this section was a welcome refresher to this offensive discipline, from a defensive perspective. However unlike the PEN-200 course, understanding persistence is integral to the SOC-200 course, and is required to pass the associated exam.

This section covers several different techniques an attacker may leverage to obtain persistence on a windows endpoint, including persistence via windows services, scheduled tasks, DLL hijacking, registry keys.

Some of these techniques are demonstrated in the labs via metasploit, others are done so in a manual low level manner. The high level explanations of these attacks, and the information regarding thier detection is well presented, the command samples of registry key exploitation for instance are very clear, and easy to comprehend.

There isn’t anything overtly lacking from this section I can identify, the associated MITRE information was a great resource to flesh out this type of adversary activity.

Rating: 5/5

8). Linux Endpoint Introduction: This section covers how one can audit a linux endpoint via the use of various linux specific log sources. and how these logs can be read, as well as the development of python scripts to help automate these tasks.

This section is short and straight to the point, one should come into this section with some familiarity of standard linux commands, as this section uses many without explaining what they do, assuming the reader is already familiar with terminal commands.

If one is not familiar with linux usage I would suggest reading the free book Kali Linux Revealed, as it will provide one with an excellent primer on linux commands, and system fundamentals.

This module is short, sweet, and to the point, however one wishing to obtain a deeper understanding of linux system operations from a lower level should supplement their learning with Kali Linux Revealed.

Fun fact: Gamb1t asked me to provide input on the Kali Linux Revealed book, and as a thank you G0tm1lk sent me some offensive security swag (no Kali challenge coin though), I am also certified as a KLCP.

Rating: 4/5 (supplement learning with Kali Linux Revealed)

9). Linux Server Side Attacks: This section is concise depicting common server side attacks that an adversary will use, by no means are the attacks demonstrated comprehensive. The attacks covered are bruteforce attempts against ssh, sql injection via the sqlmap tool, as well as the shellshock exploit. The attack vectors that are discussed are demonstrated in a coherent manner, and the identification of these attacks is also illustrated in an understandable way.

It does feel like there was a missed opportunity to discuss the network, and service enumeration tools attackers use, both in this section as well as the complementary Windows server side attacks module; tools such as nmap, nikto, wpsscan ect.

It’s not that this section is awful, but it does feel like some subjects could have used further elaboration.

Rating: 3.5/5

10). Linux Privilege Escalation: This section gives a general overview of basic methodologies an attacker would use to escalate privileges on linux endpoints. Those being the sudo -l command to determine user service privileges, reading and manipulating the shadow file, exploiting weak permissions, ect.

This section is very lean, and could use a lot more content, including how to determine common attacker privilege escalation scripts such as linpeas, linenum.sh, ect. The PEN-200 course was pretty light on linux privilege escalation material, the SOC-200 is even lighter on this content.

The attacks, and detection methods that are discussed are explained in an digestible manner that can be easily understood, but to supplement knowledge of linux privilege escalation attacks I would suggest the Tib3ruis linux privilege escalation course on udemy, and associated room on TryHackme.

It could be that other associated attacks would be difficult to determine on a linux endpoint.

Rating: 3/5

11). Network Detections: This section covers tools used to determine network attacks, including a quick and dirty primer on snort usage, as well as wireshark. It’s very basic information on tool usage, the associated labs are good practical examples to introduce one to these tools, but one is going to need to do their own research to get good with these tools.

The practical section examines the ZeroLogon exploit, and gives a very brief mention of the pyramid of pain framework, this framework is something a student should absolutely look into further.

The depiction of the domain flux defense evasion technique was very interesting, and illuminating, as was the usage of powershell empire. The lab discussing user-agent identification was informative, and the resource used to do so is important for a defense analyst to keep in thier toolbox.

Rating: 3.5/5

12). Antivirus Alerts and Evasion: This section concerns adversary techniques to bypass endpoint defensive capabilities, and antivirus software that utilize Signature-Based detection, as well as Behaviour based detection.

Signature based detection is the identification of malicious scripts, binaries, or software based on the known associated signatures, for instance hash values, the module makes use of MpCmdRun.exe for this purpose.

Defense evasion in these instances can include, but is not limited to string manipulation to cloak a known value.

Behavior based detection is leveraged against novel attacks that can’t be identified by a signature, and is based off of forming a baseline on normal behavior, then searching for anomalous patterns on an endpoint that could be indicative of a compromise. The module makes use of Windows real-time protection to detect these potentially malicious patterns.

The final portion of this module concerns the Antimalware scan interface, it’s use case to identify fileless malware attacks, and ways an attacker may defeat this, and countermeasures to identify this activity. This section of the module is excellent, the explanation of the attacks potential consequences, and the methodology to detect this is very good, it’s easily the best explanation I’ve come across regarding this subject.

That said the module is not without it’s faults, I wish they discussed identification of malicious malware through hashes, via online database tools like www.talosintelligence.com. I am aware this is covered in the OSTH course, but there is no reason it couldn’t also be discussed, or at least mentioned here. Additionally attacker signature subversion via fuzzy hashing should have been discussed.

The associated labs were for the most part good, however I found the last two were not explained in enough detail for the student to understand how to perform the exercise, specifically from where to execute the script required to do the exercise, it was very confusing, but to save you some trouble the script needs to be executed from the Administrator desktop.

Rating: 4/5

13). Network Evasion and Tunneling: This section discusses network segmentation, egress busting, and tunneling. The portion discussing network segmentation provides illustrations to accompany the explanation provided, and is does a good job outlining the theory.

Subsequent topics include the use of iptables usage for firewall setup, and how an attacker can perform egress busting against these implementations, and snort detection of egress busting.

The last portion of this section concerns port forwarding, and tunneling, and the tools attackers may leverage to pivot through a network, it’s good stuff. The theory is strong, and the demonstrations provide a clear explanation to truly understand what is occuring within an attack chain leveraging this technique, the mention of robots.txt files as a common potential vulnerability did not go unappreciated, nor the attack demonstrating mounting shares.

There isn’t much I can fault in this chapter, perhaps more pivoting tools could have been mentioned such as chisel, ligolo, ect. It would have been nice, but perhaps those tools weren’t around when this was initially written, it’s not terribly important though, as understanding the attacker methodology, and detection of it should be sufficient against a universal set of attacker tools.

Additionally, the Kali Linux Revealed book offers more information on iptables, and should be used as a supplementary resource to further expand on the topic for those interested.

Rating: 5/5

14). Active Directory Enumeration: The beginning of this section provides a good theoretical explanation of LDAP, and how it may be enumerated with PowerView.ps1, as such it should be noted that this section concerns enumeration of active directory from within an endpoint, instead of from the perimeter.

The following topics discussing detection via audit object access, baseline monitoring were well done. Unfortunately, the coolest detection method being the usage of honey tokens to set up traps for an attacker (while explained well from a theoretical standpoint), I felt required a lower level explanation, and walkthrough to help a defense analyst develop thier own.

The associated labs were well done, but once again the last two were confusing in the sense I didn’t know where the scripts were supposed to be executed from, more clarity on how these labs were intended to be performed would have been appreciated.

Rating: 4/5

15). Windows Lateral Movement: This section discusses how an attacker is able to leverage common attacks to leverage compromised access on one endpoint, to gain a foothold on other endpoints within a network via pass the hash, brute forcing domain credentials, and terminal services.

The mimikatz, kerberoasting, and psexec tools are discussed, and thier associated usage to perform attacks is illustrated, all the attacks covered are done so in an informative, and understandable manner. The detection scripts leveraged in the labs are great, and thier usage is well explained.

This section is short, but very concise, it gives one everything they need to know to understand these attacks from a low level in a digestible format.

Rating: 5/5

16). Active Directory Persistence: This section concerns the post compromise techniques an attacker can use to maintain access across active directory, leveraging the following methods, domain group membership, domain user modifications, and golden tickets.

All of these are explained in a manner that is low level enough for one to understand how these attacks work, and how to detect them. I think the structure of this module should be commended, as saving golden tickets as the final attack discussed, whether intentional, or not, seems to highlight how serious the consequences of this level of access is, should an attacker manage to obtain it.

The associated labs, and detection scripts are excellent, if once again lacking in clarity of the steps required to properly perform them.

Rating: 4/5

17). SIEM Part One: Intro to ELK: This portion of the course discusses the elkstack framework, what it is, and how it works for endpoint investigations, as well as the Kibana interface, KQL language, and OSQuery module usage.

Additional topics include rule development, alert investigation, and timeline usage. The rule development portions in particular were well done, easily the best low level explanations I’ve read on this subject.

What’s covered here is good, but I feel there could have been a mention of Lucene language, EQL language, and a deeper dive into regular expressions that may be used to create more delineated queries.

The labs were good to illustrate the concepts, and I was fortunate enough that I was able to use them without trouble. Unfortunately, and this is a big thing, these labs which are integral to understanding this tool are not working right now, it’s absolutely not fair to students, given that the exam requires the student to understand, and use Kibana for the exam.

Rating: 4/5

18). SIEM Part Two: Combining the Logs: This section, much like the PEN-200 final module is a guided walkthrough of an endpoint investigation using Kibana, and well as rule development.

This section is perfect as a practical primer on the tool, but as stated previously, these labs are not currently functioning. My rating below is based off of the module access I did when it was functioning properly.

Rating: 5/5

19). Trying Harder: The Labs: This section just provides general onboarding to the upcoming lab section, and gives a brief overview on the OSDA exam.

Rating: N/A

The Labs:

I’m not going to review each individual lab, but I can say this in general regarding all of them, as far as Kibana based labs go, these may very well be the best on the market. The early labs are comparable in difficulty to some of the more advanced labs on platforms such as tryhackme, and BTLO, later labs such as 12 are very realistic, with a depiction of a more advanced adversaries actions taking place, that do away with overt red herring indicators of compromise seen in early labs. I am not knocking those early labs either, the red herrings in early labs are done to ease a student into getting thier feet wet, you need to walk before you can run.

The structure of the labs scales in difficulty chronologically, unlike the 2022 PEN-200 labs which had no indicator in terms of difficultly, which is a welcome design choice. There is nothing more dishearting than spending months going through a course, then feeling like you didn’t learn anything because you’re having trouble with your first lab. The SOC-200 labs start from easiest to most difficult, lab 1 being the easiest, and lab 13 being the most difficult.

Each of these labs are worth doing, and none should be skipped, additionally the associated OSA videos should all be watched in tandem with their associated lab, the instructor is excellent, and their methodology and reasoning for said methodology are the definition of Gucci.

Anans3 is a phenomenal instructor, and deserves nothing but praise, and commendations for his lessons.

These OSA videos are only available while you have an active subscription, but if you’re an offsec student, I think you can figure out some “hacker workaround” to keep them if you really want to.

The biggest problem with the lab, is not all of them worked properly, it’s a massive drawback since these labs are extremely important to practice with, and there are not any comparable external resources to subdtitute for these labs.

I was personally not able to do lab 10, and 13, of which lab 13 is arguably the most important to complete as it is the closest to the exam environment.

I think at a bare minimum offsec should offer students a one week voucher they can use later to access the labs/modules that were broken once they’re fixed, especially given that these system issues are on their end.

Fun fact: In keeping with my abysmal fucking luck during offsec courses, my daily driver computer died on me as soon as I reached the SOC-200 labs, so I actually ended up doing the labs, writing the lab reports, and my playbook from my cellphone. It was an experience, where I was seriously contemplating kissing the end of a shotgun, and booking an appointment to meet Jesus, lol.

Rating: 5/5

The Exam:

When I did the exam shit hit the fan in more ways than one, first off, it turned out my ID’s were all expired, I emailed offsec the day if to find out whether I would be able to still take the exam, I received a belated response after I was already in the proctor waiting room basically saying no. But since I was already in the proctor session my fate would be decided by the associated staff on that end, after 2 hours of deliberation I was granted the opportunity to do the exam, with a fair warning that this would be a one time courtesy gesture, in part because I had already done, and passed previous offsec exams prior, but I would not have the ability to do any future exams without a valid physical ID.

I can’t explain the mixture of feelings I had at that time, I was elated, but also feeling sickeningly stressed because I had lost 2 hours of exam time, and because if I failed, I knew it would take months and hundreds of dollars before I would be able to rechallenge the exam due to needing to acquire new ID’s.

Prior to the exam I had built a playbook with different queries I had developed to look for specific threats, and I had done several mock lab reports, so these two things helped during my exam as I had a framework of how the report would be written, and something to lean on if I got stuck.

My methodology was straight manual enumeration, and KQL query usage, as well as the rare OSQuery sqli query. With regards to OSQueries, it is something that has a massive risk/reward aspect during the exam, so I only wanted to use it if absolutely necessary.

I did not use rules, or dashboards.

I was able to find most if the initial activity fairly easily, the worst part of the exam was the reporting, there is an absolutely overwhelming amount of activity to report. I’ve heard from multiple OSCE3’s that as far as the lab report goes, the OSDA is the most demanding they’ve done out of the other offsec courses, whether you pass or fail is going to depend heavily on how you present your findings in the report.

Later activity became much harder to detect, part of it was tunnel vision, and not seeing the “bigger picture”, and the other part of it was the attacker activity just became very clandestine, looking back I would say one going into the exam should view the attackers actions from the prism of what is realistic.

My playbook also did come in handy on a few occasions to find attacker activity when I was stuck.

There was one phase near the end, where I couldn’t find any activity, I’m still perplexed to this day, I made an executive decision to just proceed, and try and score enough points with the remaining phases to hopefully pass. I have my suspicions that this may have been an intentional curveball, but I’ll never know.

After 23 hours awake, I had completed all the phases, and written the first draft of my report, the last hour was spent just trying to go back through different phases to see if there was any potential attacker activity I had missed. Once my lab time was over, I went home, showered, slammed a beer, and got onto the process of working on the polished version of my report, including images, and sources.

In total I was up for 40 hours straight, with six hours left before the exam report was due, and coming close to literally falling asleep at my desk, I wrapped up my exam report, compressed it, then uploaded it to offsec at 03/04/2025 and awaited my fate…

After several days of turmoil wondering if I had passed, on a Sunday on 03/09/2025 I received the email informing me I had passed. Feels good man.

I don’t think it’s much of a secret, I haven’t been the biggest fan of the way offsec operates, or that I think some of their courses lack the material needed to equip a student to pass the associated exam, but I have, and will continue to maintain, that the offsec exams are excellent, and the best in the industry.

Rating: 5/5

Fun fact: Over the course of my exam my computer kept crashing, every time I connected to the proctoring software my laptop would just begin to sound like an airport, sometime later my computer would crash, and each time it occured it would take 20–30 minutes to login, set up my Kali VM again, include all my kibana filters, and readjust the timeline. Also during my exam there was a goddamn earthquake, and shit flew off the walls in the kitchen I was doing the exam in, come morning my friend needed to use the kitchen to clean up, and make breakfast, so I needed to move to the living room, which meant I needed to go through the proctoring process all over again. I was exhausted, and these external factors made it so I came very very close to throwing in the towel.

Reflections on the community:

Unlike the PEN-200 associated discord channels, the SOC-200 ones are much smaller, the community is generally nicer, unfortunately a lot of the offsec student mentors by their own admission are not familiar with this kind of content, so getting help with the course can de difficult depending on who is working.

Likewise you’re generally going to be relying on students for the labs to figure things out, the student mentors will not easily provide you with the reasoning of an adversary action. For instance on one occasion after prodding a student mentor repeatedly about an action I had associated with the attacker, they basically told me I was wrong, and I needed to demonstrate provable correlation, this was a moment when things clicked together for me, but it wouldn’t had occured if I didn’t press for it.

Generally though, in these instances, and I hate to say it because it sounds so caustic, google is your friend, also if you are going to ask for help show all your steps to demonstrate you made a good faith effort to figure things out on your own.

Reflections on course criticisms:

I’ve heard from others who had done the exam, that the course material was very basic, or paradoxically that the course didn’t prepare them enough for the exam.

Often these people didn’t actually complete the course, so the question is can you criticize something you didn’t complete? I guess so, but there will be more validity to your opinion if you do complete the course.

With regards to not passing the exam as a result of insufficient, or irrelevant course material, I can understand some of that frustration, the course itself feels like constant whiplash, you’re performing adversary attacks, then switching to a defense role to detect them, and for 80% of the course your doing so from a endpoint specific low level, then switching to god-mode with Kibana at the end. And if you’re coming to this course from a newbie perspective without either a defensive, or offensive background I can understand how overwhelming this can be, the thing is all the modules prior do give you a foundation to understand how attacks look like, and some common Event ID’s used to detect them.

The Kibana portions are enough to learn to use the tool, and the only thing more that could really be done is provide the user with Kibana queries, but doing so would almost seem like a disservice, the student needs to develop this skillset on their own by doing the labs.

If there was one module I felt was missing from the SOC-200 it would be on writing a good report, the current OSCP has this, and I feel it’s much less relevent to that course.

The labs, and modules need to get fixed asap, and the current students unable to access them should be provided with some kind of voucher for lab time later once they’re fixed, it’s unacceptable to pay that much money, and not have access to the materials required to learn/pass.

I also wish that there was a way to directly download the PowerShell scripts from the course modules, if someone can save, and then upload them to the OSA board it would be a great deed worthy of a steam card of nominal worth.

Course final thoughts:

For SOC operations the SOC-200 course is unique, and phenomenal in the industry landscape, giving the student not only insight into a defense analyst role, but also how an attacker operates from an adversary perspective.

In total, I spent 60 8–12 hour days doing the course, and completed 99.1 percent of the course, and all labs except 10, and 13 (due to them being busted). Unlike the PEN-200 everything one needs to pass the exam is encompassed within the course, but there are a few external resources that will give one an additional edge.

The course authors which often don’t get enough credit deserve it for this course, so C0ntra, Tristram, kudos.

Final Rating: 4/5

What’s Next:

I’d like to work as a private contractor, which may be easier said than done, since getting this certification I’ve been offered several employee positions, likely because at least on the government side the OSDA is the highest qualification in Canada on the gubernment side.

I also might try and teach the course, or relevant disciplines, I also bought the BTL1 so I plan to go through that course soon. And git good with burpsuite, I plan to re-challenge the OSCP next year.

I will eventually accompany this review with a survival guide for the course, but for now a cigarette, and libation is what is on the agenda, time to drink all the booze and, well you know…