seclab/.claude/SYLLABUS_Cybersecurity_Applied_Lab.md

# FILE: SYLLABUS_Cybersecurity_Applied_Lab.md
# SYLLABUS: CYBERSECURITY APPLIED LAB
**Apophis Networking - Security Operations Center Training Program**

---

## Course Overview

This self-study curriculum transitions theoretical cybersecurity concepts into applied, hands-on experience. By building a functional, segmented enterprise-grade network range within a virtualized environment, you will develop the foundational skills necessary to launch a cybersecurity venture, such as Apophis Networking, or operate within a modern Security Operations Center (SOC).

**Program Objectives:**
- Master both offensive (Red Team) and defensive (Blue Team) security techniques
- Build and operate a production-grade SOC infrastructure
- Develop incident response and digital forensics capabilities
- Understand real-world attack chains and detection engineering
- Create professional security documentation and reporting

**Target Audience:**
- Self-learners pursuing cybersecurity careers
- IT professionals transitioning to security roles
- Students preparing for industry certifications (Security+, CySA+, OSCP)
- Aspiring penetration testers and SOC analysts

---

## Core Architecture

The laboratory is built entirely within a Proxmox hypervisor. Network segmentation is achieved via 802.1Q VLAN tagging and routed through a virtualized firewall appliance (pfSense/OPNsense) to ensure malicious traffic remains isolated from your physical home network.

### Network Segmentation Strategy
* **VLAN 100 (Management):** 10.10.1.0/24 - Proxmox Web GUI, Firewall Management.
* **VLAN 200 (Red Network):** 10.10.2.0/24 - Attacker subnet (Kali Linux).
* **VLAN 300 (Blue Network):** 10.10.3.0/24 - Defenders/SOC (Security Onion).
* **VLAN 400 (Victim Network):** 10.10.4.0/24 - Vulnerable targets (Windows/Linux).

### Virtual Machine Inventory
1. **pfSense** (Firewall/Router)
2. **Kali Linux** (Red Team Operations)
3. **Security Onion** (Network Security Monitoring)
4. **Metasploitable 2** (Linux Target)
5. **Windows Server 2022** (Domain Controller)
6. **Windows 10** (Domain Endpoint)

---

## Curriculum Structure

| Module | Title | Duration | Key Skills |
|--------|-------|----------|------------|
| **MOD0** | Prerequisites & Fundamentals | 8-12 hours | Linux CLI, Windows PowerShell, Networking, Virtualization |
| **MOD1** | Secure Infrastructure Provisioning | 4-8 hours | VLAN tagging, pfSense, Firewall rules, Network segmentation |
| **MOD2** | Reconnaissance & Network Traffic Analysis | 8-14 hours | Nmap, Wireshark, Service enumeration, PCAP analysis |
| **MOD3** | Exploitation & Post-Exploitation | 10-17 hours | Metasploit, Reverse shells, Privilege escalation, Persistence |
| **MOD4** | Defensive Monitoring & the SOC | 6-10 hours | Security Onion, IDS/IPS, Suricata rules, Alert triage |
| **MOD4.5** | SIEM Operations & Log Analysis | 6-10 hours | KQL queries, Kibana dashboards, Alert tuning, Correlation |
| **MOD5** | Active Directory Threat Emulation | 8-12 hours | AD deployment, Kerberoasting, Pass-the-Hash, Domain attacks |
| **MOD6** | Incident Response & Digital Forensics | 10-15 hours | Disk forensics, Memory analysis, PCAP forensics, IR reporting |
| **MOD7** | Web Application Security | 8-12 hours | OWASP Top 10, SQL injection, XSS, Burp Suite, WAF |
| **MOD8** | Threat Intelligence & Hunting | 6-10 hours | MITRE ATT&CK, IOCs, Sigma rules, Hypothesis-driven hunting |
| **CAPSTONE** | APT Simulation Project | 16-24 hours | Integrated Red/Blue exercise, Full IR lifecycle, Reporting |

**Total Program Duration:** 90-144 hours (12-18 weeks at 8 hours/week)

---

## Course Expectations

### Self-Directed Learning
This is a **self-paced, self-driven** laboratory curriculum. You are expected to:
- Break the environment intentionally (that's how you learn)
- Troubleshoot routing issues, firewall rules, and VM problems independently
- Analyze packet captures and log files for clues
- Rebuild systems from snapshots when something breaks
- Research error messages using Google, Stack Overflow, Reddit

**The documentation serves as a guide, not a step-by-step walkthrough.** Successful completion requires independent research, critical thinking, and logical problem-solving.

### Time Commitment
- **Minimum:** 8-10 hours per week for 12-14 weeks
- **Recommended:** 12-15 hours per week for faster progress
- **Intensive:** 20+ hours per week to complete in 6-8 weeks

### Documentation Requirements
Every module requires:
- **Lab Report:** Following LAB_REPORT_TEMPLATE.md format
- **Screenshots:** Minimum 5 per module (more for complex modules)
- **Command History:** Export of all commands executed
- **PCAP Files:** Network traffic captures of key activities
- **Deliverables:** Specific outputs listed in each module

### Assessment
- **Module Completion:** Each module graded on 100-point rubric (see ASSESSMENT_RUBRICS.md)
- **Capstone Project:** 200 points (comprehensive assessment)
- **Overall Grade:** Total 1200 points across all modules
- **Passing Grade:** 70% (840/1200 points)
- **Excellence:** 90%+ (1080/1200 points) - ready for OSCP-level challenges

---

## Professional Development

### Certification Pathways

**After completing this curriculum, you will be prepared for:**

**Entry-Level Certifications:**
- CompTIA Security+ (if not already obtained)
- CompTIA CySA+ (Cybersecurity Analyst)
- CompTIA PenTest+ (Penetration Testing)

**Advanced Certifications (with additional study):**
- **Offensive Security Certified Professional (OSCP)** ← Highly recommended next step
- GIAC Certified Incident Handler (GCIH)
- Certified Ethical Hacker (CEH)

### Career Roles
1. **SOC Analyst (Tier 1/2)**
2. **Penetration Tester**
3. **Incident Responder**
4. **Detection Engineer**
5. **Threat Hunter**
6. **Security Consultant**

---

## Module Files

All module documentation is located in the `.claude/` directory:

- **MOD0_Prerequisites.md** - Linux, Windows, Networking, Virtualization fundamentals
- **MOD1_Secure_Infrastructure.md** - Proxmox, pfSense, VLAN configuration
- **MOD2_Recon_and_NTA.md** - Nmap, Wireshark, Service enumeration
- **MOD3_Exploitation.md** - Metasploit, Post-exploitation, Persistence
- **MOD4_Defensive_Monitoring.md** - Security Onion, IDS/IPS, Custom rules
- **MOD4.5_SIEM_Operations.md** - KQL, Kibana dashboards, Log correlation
- **MOD5_Active_Directory_Emulation.md** - AD attacks, Kerberoasting, Lateral movement
- **MOD6_Incident_Response.md** - Forensics, Timeline analysis, IR reporting
- **MOD7_Web_Application_Security.md** - OWASP Top 10, Burp Suite, WAF
- **MOD8_Threat_Intelligence.md** - MITRE ATT&CK, IOCs, Threat hunting
- **CAPSTONE_APT_Simulation.md** - Integrated Red/Blue team exercise

### Supporting Documentation
- **LAB_REPORT_TEMPLATE.md** - Standard format for all lab reports
- **ASSESSMENT_RUBRICS.md** - Grading criteria for all modules
- **SYLLABUS_Cybersecurity_Applied_Lab.md** - This file

---

## Resources & Support

### Required Software (All Free/Open Source)
- Proxmox VE (hypervisor)
- pfSense (firewall)
- Kali Linux (penetration testing)
- Security Onion (SIEM/IDS)
- Metasploitable 2 (vulnerable target)
- Windows Server 2022 (evaluation license)
- Windows 10 (evaluation license)

### Recommended Study Materials
- **Books:**
  - "The Linux Command Line" by William Shotts (FREE PDF)
  - "The Web Application Hacker's Handbook" by Stuttard & Pinto
  - "Practical Malware Analysis" by Sikorski & Honig

- **Videos:**
  - Professor Messer (Network+, Security+)
  - IppSec (HackTheBox walkthroughs)
  - HackerSploit (YouTube channel)

- **Practice Platforms:**
  - TryHackMe (guided learning paths)
  - HackTheBox (realistic VMs)
  - PentesterLab (web app security)

---

## Academic Integrity

### Authorized Use Policy
All tools and techniques taught in this curriculum are for **AUTHORIZED USE ONLY**:
- ✅ **Allowed:** Using these techniques on VMs in YOUR lab that YOU own
- ✅ **Allowed:** Authorized penetration tests with written permission
- ✅ **Allowed:** CTF competitions and training platforms
- ❌ **ILLEGAL:** Using these techniques on unauthorized systems (18 U.S.C. § 1030)

---

**GOOD LUCK, AND WELCOME TO APOPHIS NETWORKING!**

*"Order from Chaos" - Building security professionals one lab at a time.*

---

**END OF SYLLABUS**