SOC Analyst & Blue Team
Windows Security
Endpoint architecture, permissions, logs, firewall, PowerShell, EDR, harden.
Eight practical Windows Security labs on isolated VMs: architecture (UAC/Defender/Security Center), users and NTFS permissions, services/startup, Event Viewer 4624/4625 and PowerShell logging, firewall and netstat audits, PowerShell execution policy and Script Block logging, AV/EDR response concepts, and a hardening checklist (privilege audit, patching, credential protection). Never target production hosts.
- Level
- Intermediate
- Duration
- 4–6 weeks
- Modules
- 4 modules · 12 lessons
- Learning method
- Lessons + labs
What you will learn
- Explain UAC, Defender, and Security Center roles on Windows
- Enumerate identity and audit NTFS ACLs with whoami, net user, and icacls
- Find insecure services, processes, and startup persistence on a lab VM
- Correlate 4624/4625 and PowerShell 4104 events in lab logs
- Audit firewall profiles/rules and unexpected listeners with netstat
- Detect suspicious PowerShell and apply logging/execution controls
- Outline EDR isolation and detection-response workflow
- Apply a practical Windows hardening checklist including credential protection concepts
Course curriculum
Expand each module for lessons, progress, and labs assigned to that module — not a flat topic dump.
Module 1
Architecture and access control
Windows security stack plus users, groups, and NTFS ACLs.
0/3 lessons
Module 1
Architecture and access control
Windows security stack plus users, groups, and NTFS ACLs.
0/3 lessons
Lessons
- 1. Windows Security Architecturepreview~20 min
- 2. Users, Groups and Tokens~20 min
- 3. NTFS Permissions and icacls~20 min
Enrol to unlock full lessons and track module progress.
Module 2
Services and event visibility
Startup/services abuse patterns and Security/PowerShell logs.
0/3 lessons
Module 2
Services and event visibility
Startup/services abuse patterns and Security/PowerShell logs.
0/3 lessons
Lessons
- 1. Services, Processes and Startup~20 min
- 2. Logon Events 4624 and 4625~20 min
- 3. PowerShell Event Logging Intro~20 min
Enrol to unlock full lessons and track module progress.
Module 3
Firewall and PowerShell security
Host firewall audits and constrained PowerShell operations.
0/3 lessons
Module 3
Firewall and PowerShell security
Host firewall audits and constrained PowerShell operations.
0/3 lessons
Lessons
- 1. Firewall Profiles and Rules~20 min
- 2. Listener Audit with netstat~20 min
- 3. Execution Policy and ScriptBlock Logging~20 min
Enrol to unlock full lessons and track module progress.
Module 4
EDR response and hardening
Telemetry-driven response and a durable hardening baseline.
0/3 lessons
Module 4
EDR response and hardening
Telemetry-driven response and a durable hardening baseline.
0/3 lessons
Lessons
- 1. AV/EDR Telemetry and Isolation~20 min
- 2. Privilege and Patch Audit~20 min
- 3. Credential Protection and Hardening Checklist~20 min
Enrol to unlock full lessons and track module progress.
Inside this course
Labs · Quizzes · Certificate
Labs below are curated for this syllabus (shared engine, course-specific assignments). They unlock with enrol; quizzes match course topics; finish ≈90%+ to claim a CYNARKS Academy certificate.
Course labs
8 assigned labs · free with this course enrol
- Windows Security FundamentalsUnlock via course or plan
- Users, Groups & NTFS PermissionsUnlock via course or plan
- Services, Processes & StartupUnlock via course or plan
- Event Viewer & Auth Log HuntUnlock via course or plan
- Windows Firewall & Network AuditUnlock via course or plan
- PowerShell Security & LoggingUnlock via course or plan
- AV/EDR Telemetry & ResponseUnlock via course or plan
- Windows Hardening ChecklistUnlock via course or plan
Track quiz
356 questions matched to this course topics
Knowledge checks for this track only — not a separate global quiz menu.
Start track quizCYNARKS certificate
Educational completion certificate · verify by ID
Your progress: 0% · enrol to unlock claim
Enrol in this course first.