Unit 01 · 1 h 20 min
Who attacks and how
Meet the people behind attacks, follow an intrusion stage by stage and turn an advisory into checks.
The Modern Threat Landscape
Investigate phishing, AI-written scams, deepfake calls, account takeovers and ransomware the way a SOC analyst does.
- Time
- 16 h 12 min
- Lessons
- 51
- Machine
- Ubuntu 24.04 LTS
- Builds on
- Linux FoundationsHow the Web Works
What you earn
RootCertificateThe Modern Threat Landscape, certificate of completion CompTIASecurity+CompTIA Security+ ISC2CCCertified in Cybersecurity
Prepares you for CompTIA Security+ and Certified in Cybersecurity. Root is not affiliated with these issuers.
You will be able to
- Turn a threat advisory into log searches
- Triage phishing, QR codes, AI-written scams and deepfake requests
- Read SPF, DKIM, DMARC and a Received chain
- Catch fake CAPTCHA, fake interview and supply chain lures on Windows and macOS
- Trace account takeovers that start with a call, a text or a reset
Units and lessons
Unit 02 · 1 h 56 min
Anatomy of a phishing email
Read reported emails safely, catch lookalike senders and lying links, and name the pressure behind them.
Unit 03 · 1 h 32 min
AI scams, deepfakes and verification
AI makes scams fluent and faces fake. Learn the checks that still work: channel, record and process.
Unit 04 · 1 h 18 min
Email authentication and headers
Trace a message hop by hop, read SPF, DKIM and DMARC results and use DMARC reports to see who sends as you.
Unit 05 · 2 h
Suspicious links and attachments
Unwrap links, identify files by their bytes and check hashes, all without opening or running anything.
Unit 06 · 1 h 34 min
Account takeover and MFA fatigue
Follow a stolen password from sign-in to persistence: impossible travel, MFA push spam, token reuse and mailbox rules.
Unit 07 · 1 h 56 min
Phone, SMS and help desk attacks
Catch the calls and texts that talk staff into resets, app approvals and codes, and close the gaps they use.
Unit 08 · 1 h 14 min
Ransomware from the defender's side
Spot the hours of warning before encryption, check that backups would survive and run the first hour of response.
Unit 09 · 1 h 50 min
Third parties and the supply chain
Attacks that arrive through someone you trust: fake updates, hijacked supplier mailboxes, extensions and vendor access.
Unit 10 · 1 h 32 min
Reporting and incident communication
Scope the phishing incident from the logs, build one timeline, write the report and tell staff in plain words.
Ten units of cases at Northwind Freight, each tied to a real incident, from a sector advisory to a written report. Everything is read, decoded and checked, nothing is run.