Student edition · v22

Lab Scripts

Individual validated scripts, rules, datasets, and supporting files used in the Progressive Labs and Field Guides.

PL-00Shared reset tool for PL-00–PL-09 · Windows · AdministratorReset WIN11 telemetryLab_00_Reset_WIN11_v20.ps1Download →PL-00Shared reset tool for PL-00–PL-09 · Linux · sudoReset UB2604 sensor logsLab_00_Reset_UB2604_v20.shDownload →PL-00Shared reset tool for PL-00–PL-09 · Linux · sudoReset WAZUH-SRV alert dataLab_00_Reset_WAZUH-SRV_v20.shDownload →PL-00AProgressive Lab PL-00A · Windows · AdministratorCreate controlled EICAR test fileLab_00A_Create_Controlled_EICAR_Test_File_v20.ps1Download →PL-00AProgressive Lab PL-00A · Windows · PowerShellReview Defender EICAR telemetryLab_00A_Review_Defender_EICAR_Events_v20.ps1Download →PL-00AProgressive Lab PL-00A · YARA ruleEICAR YARA validation ruleLab_00A_EICAR_Test_Rule_v20.yarDownload →PL-05Progressive Lab PL-05 · Windows · AdministratorGenerate Sysmon investigation telemetryLab_05_Generate_Sysmon_Investigation_v20.ps1Download →PL-06Progressive Lab PL-06 · Windows · AdministratorGenerate network attack telemetryLab_06_Generate_Attack_Telemetry_v20.ps1Download →PL-06Progressive Lab PL-06 · Linux · standard userGenerate periodic beacon trafficLab_06_Generate_Beacon_Traffic_v20.shDownload →PL-07Progressive Lab PL-07 · Data fileIOC enrichment datasetLab_07_IOC_Enrichment_Dataset_v20.txtDownload →PL-08Progressive Lab PL-08 · Windows · AdministratorGenerate FIM change burstLab_08_Generate_FIM_Change_Burst_v20.ps1Download →FG 06Field Guide 06 · DOCX, PDF, scripts, source map, and checksumsField Guide 06 complete packageFG06_Lab_Cleanup_Package_v22.zipDownload →SCRIPTField Guide 06 component · Linux · sudo · instructor-controlledSafely clean Suricata lab telemetrycleanup-suricata-lab_v20.shDownload →SCRIPTField Guide 06 component · Linux · sudo · instructor-controlledSafely clean Wazuh lab telemetrycleanup-wazuh-lab_v20.shDownload →SCRIPTField Guide 06 component · Windows · Administrator · instructor-controlledSafely clear Windows and Sysmon lab logsClear-Windows-Sysmon-LabLogs_v20.ps1Download →FG 07Field Guide 07 · Macro-free Excel workbookInitial SOC triage workbookInitial_SOC_First_15_Minutes_v7.xlsxDownload →FG 07Field Guide 07 · Four-page PDFInitial SOC triage print previewInitial_SOC_Main_Sheet_Print_Preview.pdfDownload →FG 07Field Guide 07 · Workbook, print preview, and fictional exampleField Guide 07 complete packageFG07_SOC_Triage_Package_v22.zipDownload →FG 08Field Guide 08 · PDF and editable WordCyber Incident Executive Summary complete packageFG08_Executive_Summary_Package_v21.zipDownload →FG 09Field Guide 09 · Linux and Windows · lesson v23Forensic Container Student KitFG09_Student_Kit_v23.zipDownload →REFERENCEPacket parsing companion · MHT browser archive · v7.1Packet Parsing Tool SummaryPacket_Parsing_Tool_Summary_v7.1.mhtDownload →