SANS Institute’s SEC504 takes a dual-use approach: it teaches defenders the tools and methods attackers use, so they can detect, contain and recover compromised systems faster. Covering on-premises and cloud environments, the course aims to reduce the real losses caused by intrusions and prepares students for the GIAC Certified Incident Handler (GCIH) certification.
🔑 Key takeaways
- A detection-and-response course with an offensive component designed to explain attacker methods.
- Two complementary frameworks: DAIR (SANS approach) and PICERL (NICCS reference).
- Six technical modules, including a one-day Capture-the-Flag event on a cyber range.
- A six-day AWS Marketplace licence, a separately sold GCIH exam, and CPE (continuing education) credits listed as 37 or 38.
A double-edged curriculum: attack to defend better
SEC504 covers the tools and techniques attackers use, along with exploitation and incident handling. The program spans on-premises and cloud systems. Despite its prevention focus, the SANS brochure stresses detection and response, because compromise remains possible even in well-protected environments. Students learn to identify intrusions on Windows, Linux and in the cloud, then to contain incidents, reduce their impact and restore operations.
The course prepares students for the GIAC Certified Incident Handler (GCIH) certification, which validates a professional’s ability to detect, handle and resolve security incidents.
Two methodologies for one response lifecycle
The sources use two closely related frameworks. The SANS brochure presents the dynamic DAIR approach: verify, delimit, contain, evaluate and correct threats. The CISA-hosted NICCS profile presents the PICERL methodology: preparation, identification, containment, eradication, recovery and lessons learned.
| Framework | Source | Steps | Logic |
|---|---|---|---|
| DAIR | SANS brochure | Verify, delimit, contain, evaluate, correct | Dynamic approach applied to real compromises |
| PICERL | NICCS profile (CISA) | Preparation, identification, containment, eradication, recovery, lessons learned | Structured six-phase cycle |
The two approaches overlap substantially, and the right choice depends mainly on an organization’s internal standards. A team already running PICERL will recognize its containment and eradication phases immediately. NICCS rates SEC504 at proficiency level 2, described as “intermediate”, and offers three formats: in-person, live online with an instructor, and self-paced online. Basic networking and security knowledge is recommended as a prerequisite.
A six-module program
Stated objectives include host, network and log analysis, cloud incident response best practices, live analysis investigations, network investigation and memory forensics, and protection of critical assets. The syllabus also covers evasion of detection tools, exploitation of complex cloud vulnerabilities, internal discovery, lateral movement after initial compromise, and bypassing access controls. Metasploit, Nmap, Nessus, Netcat and Wireshark are among the tools cited.
Incident response and computer forensics
The first module applies the DAIR method to real compromises. It covers digital investigations, live examination, network and memory investigations, malware and cloud investigations, and a hands-on exercise called “Linux Olympics”.
Reconnaissance, scanning and enumeration
The second module introduces the MITRE ATT&CK framework, open-source intelligence (OSINT), DNS querying, website reconnaissance, network and host scanning with Nmap, cloud scanning and the search for hidden cloud targets. It also covers SMB sessions and the defensive tool DeepBlueCLI.
Password and access attacks
The third module addresses password attacks, fingerprinting and password cracking, domain password auditing with DPAT, insecure cloud storage and Netcat.
Public and clickless attacks, then post-exploitation
The fourth module presents Metasploit, browser attacks, code execution through Microsoft Office documents, command injection, XSS, SQL injection, and SSRF and IMDS attacks in the cloud. An associated defense focuses on monitoring system resource usage. The fifth module covers evasion and post-exploitation: bypassing endpoint protections, pivoting and lateral movement, hijacking attacks, log tampering, persistence, threat analysis with Real Intelligence Threat Analytics, and data collection.
Capture-the-Flag under realistic conditions
The sixth module is a one-day CTF event. Participants act as consultants to ISS Playlist, a fictitious compromised company. On a cyber range with Windows, Linux, connected devices and cloud targets, they must discover targets, compromise public assets and email accounts, attack Active Directory, test password spraying, credential stuffing (reuse of stolen credentials) and password guessing, then pivot to high-value internal hosts and exfiltrate data. A hint system supports the exercise, which can be completed as a team or individually.
Target audience and position within SANS
SEC504 is aimed at incident managers, response team leads, system administrators who directly defend platforms, first security responders, generalist practitioners and architects designing resilient systems. The course belongs to SANS’s “Core Techniques” and “Offensive Operations” tracks, the latter including penetration testing and red and purple team work. The NICCS profile maps it to the NICE “Protection and Defense” category, the “Cyber Resiliency” competency, and defensive cybersecurity, incident response and infrastructure support functions.
“Attacker tools and techniques have changed, and we must change our incident response techniques to keep up. Since I took responsibility for SEC504 in 2019, I have completely rewritten the course to give you the skills needed to succeed in incident response. Whether attacks target Windows, critical database platforms or cloud vulnerabilities, you will be ready to identify the attack efficiently, minimize its impact and respond effectively. Through your knowledge of hacker tools and techniques and your defensive skills, which significantly improve security, you will be ready to become the expert your organization needs to face today’s cyber threats.”
Joshua Wright, SEC504 course lead
Technical prerequisites and lab environment
A properly configured personal machine is required for the exercises. Virtual machines run on VMware Workstation on Windows or Linux, and on VMware Fusion on macOS. SANS supports Apple Silicon MacBooks (M1 through M5) through specialized ARM64 virtual machines, including ARM64 versions of Linux and Windows 11. Course materials are downloaded and can reach 30 to 40 GB. SANS recommends backing up the machine before training and not carrying any system containing sensitive data.
Testimonials and first-hand feedback
The brochure features several testimonials. Evan Brunk of Acuity Insurance calls the course “a very good training overall, perfect for penetration testers and defenders alike”. Alex Colclough of Clayton Homes notes that, as a developer, understanding exploits and how better coding practices strengthen your security posture is extremely useful. Joshua Nielson of Microsoft describes it as “the best training I have ever taken”. David Freedman of Nationwide Payment Solutions argues that “incident response is the most underused aspect in small businesses”.
In a review published on June 3, 2021, Ellis S describes a ten-day session held during the Covid-19 pandemic, followed by a successful GCIH exam. He reports a class of roughly 12 people, 33 labs completed on two virtual machines (Windows 10 and Linux Slingshot), reference sheets, articles, videos, six books and a substantial lab notebook. Lab questions were accessible through Firefox on port 9001. Instructor Chris Dale provided immediate feedback and examples drawn from his professional experience. The author recommends two or three screens to work simultaneously on materials, labs and applications.
AWS Marketplace pricing: points to verify
AWS sells the course as a per-person, per-seat licence, with no separate pricing tier. Each seat includes the labs, printed materials, PDF versions and lab resources. The GCIH exam is sold separately.
| Item | Information | Source |
|---|---|---|
| Duration | 6 days | AWS Marketplace listing |
| Labs | More than 30 (introduction), 44 (features) | AWS Marketplace listing |
| Labs | 33 | 2021 review |
| CPE credits | 37 (introduction), 38 (other mention) | AWS listing, SANS brochure |
| Refund | Within 30 days if the course has not been accessed | AWS Marketplace listing |
| Substitution | Possible before course access, with processing fees | AWS Marketplace listing |
The discrepancies (30 or 44 labs, 37 or 38 CPE credits) are not explained by the sources and may reflect different listings or versions. AWS states that responsibility for the product description lies with the seller. As of June 3, 2021, the detailed Medium review was the only substantive reaction available, while the AWS listing still invited buyers to be the first to leave a review.
Outlook: a demanding course to weigh against your profile
SEC504 combines a recognized methodological framework, broad technical coverage and hands-on cyber range practice. For a response team or an administrator responsible for critical platforms, the program offers a complete view of the attack cycle, from reconnaissance to post-exploitation.
Three scenarios stand out. If an organization already has a documented PICERL process and wants to train analysts in advanced detection, the course fills a concrete gap. If a team must first consolidate its networking foundations, the recommended prerequisites make a preliminary step worthwhile. If budgets are tight, the GCIH exam and the AWS licence should be compared with alternatives, taking the listing discrepancies into account. In every case, the real value will depend on the time invested in the labs.
Sources
- The Register: Hacker Techniques, Exploits and Incident Handling
- SANS Institute: SEC504 brochure
- CISA NICCS: SEC504 profile
- Ellis S, SEC504 review (Medium, June 3, 2021)
- SANS Institute: SEC504 course page
- AWS Marketplace: SEC504 listing
Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.
