Senior Instructor
Matthew Mullins
Security Researcher - Adversary Emulation
Matt Mullins is a seasoned professional within offensive security with over a decade of experience where he has worked in medical, financial, and government spaces.
See More
Rating
41
courses
courses
Courses
Red Team Operator Series: Enumeration of Assets (RTXO OSINT 102)
Once you’ve identified information of interest with OSINT, it’s time to enumerate those findings to expand your understanding. In this course, we’ll dive into tools and techniques to expand on your findings while continuing to leverage publicly available information about your organization. See what the adversaries see so you can close those holes.
Red Team Operator Series: Scanning and Identification (RTXO OSINT 101)
OSINT (Open Source Intelligence) is how most engagements begin from an adversary perspective. Be sure your organization isn’t exposing too much by leveraging the same tactics adversaries deploy. Learn to scan and identify open-source signals available to adversaries so you can mitigate these risks for your organization.
Red Team Operator Series: Leading Teams (RTXO 103)
Focuses on the program level perspectives and experience needed to run both small and large Red Teams across your organization. With challenges like timelines and budget constraints always in place, how can we complete research and have time (as a Red Team) to attack in a smart and focused way that benefits our Blue Team and entire organization?
Red Team Operator Series: Leading Operations (RTXO 102)
Focusing around the specific roles that are needed to run successful Red Team operations. The exercises throughout this course provide learners with valuable experience in managing different sections of an engagement experience, which provides everyone with a deeper understanding of the goals behind and during the actual Red Team engagement.
Red Team Operator Series: Operations Planning (RTXO 101)
Explore the exciting world of Red Team operations and how the process phases impact each engagement. Learn about threat emulation, TTPs, threat profiles, and deliver an effective report readout. Identify the perfect individual to lead your Red Team operations, and gain a new perspective to be better prepared for your role!
Red Team Operator Series: Operations Overview (RTXO 100)
Focuses on basics of designing, implementing, and maintaining Red Team operations for both smaller and larger organizations. Explore concepts of Red Teaming and how the Attack Chain works in conducting offensive operations. Review between Red & Blue operations to determine what roles are required throughout the entire incident response life cycle.
Challenge: Update B4 It's 2Late
National Cybersecurity Awareness Month has four themes; the last being 'Update Your Software.' This challenge will have you analyze a log and identify a web application attack. The goal is to piece together the narrative from the suspicious requests and understand how attacks like these can happen when you do not update your software.
Challenge: MFA ... All Day Every Day
National Cybersecurity Awareness Month has several themes, one of which is Multi-Factor Authentication (MFA). This MFA challenge will have you analyze a log and identify the potential MFA attack. The goal is to review suspicious requests and identify how MFA can be attacked in real-world use cases.
Challenge: Episode II - Attack of the Encoders
Adversaries commonly use encoding, encryption, and hashing to obscure their scripts and attacks. As a CTF player, you will need to analyze alerts and uncover the true nature of a suspicious string embedded in a file. Can you help figure out what it’s trying to say?
Challenge: The Base(64)ics
Threat actors commonly use legitimate tools in nefarious ways. As a CTF player, you’ll need to find creative ways to uncover these types of tactics. While evaluating a recent alert in your EDR, you’ve come across a weird string at the end of a powershell command. Can you help figure out what it’s trying to say?
Challenge: Spiny Shell
You receive an alert about a suspicious command execution on a Windows endpoint. Early analysis suggests PowerShell has not locked down appropriately. Can you validate if anything malicious is underway? Now that you have some basic information discovered, dive deeper into the suspicious command to identify the attacker's infrastructure and setup!
CVE Series: Follina (CVE-2022-30190)
The Follina exploit (CVE-2022-30190) is a Windows Remote Code Execution (RCE) vulnerability that could allow a threat actor to acquire an initial level of access after a successful phishing attack. Take our course to gain the skills you need to identify the vulnerability, detect it, and mitigate it (with current best knowledge).
Matt has led multiple Red Team engagements, ranging from a few weeks to a year and covering multiple security domains. Outside of Red Teaming, Matt is also a seasoned penetration tester with interests in: AppSec, OSINT, Hardware, Wifi, Social Engineering, and Physical Security. Matt has a Master's degree in Information Assurance and an exhaustive number of certifications ranging from frameworks, management, and hands-on hacking. Matt is a Technical SME at Cybrary, focusing on Adversarial Emulation and Red Teaming for course content.