DaemonCore Curriculum
Complete full-spectrum security engineering syllabus, live repeatable drills, and sealed operational scenarios.
8
Curriculum Pathways
End-to-end mission domains
127
Lessons
505 guided sections
125+ hrs
Instruction Depth
7,525 estimated minutes
16 / 16
Intel & Drills
16 references • 16 repeatable drills
150
Sealed Scenarios
18 specialist tracks
3
Principal Capstones
Enterprise closeout operations
CORE 02 // ADVANCED CYBER OPERATIONS
MAL-401 & EXP-401 Depth Verification Track
IN DEVELOPMENT
Development preview. MAL-401 and EXP-401 depth content are being built and validated locally. Advanced tracks remain unavailable to students until their fixtures, containment checks, instructor keys, and runtime certification pass.
SYSTEM SPECIFICATION // SYLLABUS DIRECTORY8 PATHWAYS • 127 LESSONS
DAEMONCORE ACADEMY
│
├── PLATFORM CONTENT
│ ├── 8 curriculum pathways
│ ├── 127 lessons
│ ├── 505 guided sections
│ ├── 7,525 estimated minutes
│ ├── 125+ hours of instruction
│ ├── 16 Intel references
│ ├── 16 repeatable drills
│ ├── 150 student-facing sealed scenarios
│ ├── 18 specialist tracks
│ ├── 3 principal capstones
│ ├── 6 adaptive Mission OS domains
│ ├── 6 role-based learning routes
│ ├── Local progress record
│ ├── Lesson scoring
│ ├── Practical evidence artifacts
│ ├── Testing Mode
│ ├── Mastery Grid
│ ├── XP and streak system
│ ├── Achievement system
│ └── Adaptive remediation
│
├── CURRICULUM PATHWAYS
│
│ ├── CORE-01
│ │ └── FULL-SPECTRUM SECURITY ASSESSMENT
│ │ │
│ │ ├── FOUNDATIONS
│ │ │ ├── Scope and rules of engagement
│ │ │ │ ├── Authorization is a technical input
│ │ │ │ ├── Build a stop condition
│ │ │ │ ├── Boundary review
│ │ │ │ └── Keep the boundary visible
│ │ │ ├── Reconnaissance as a hypothesis loop
│ │ │ │ ├── Questions before commands
│ │ │ │ ├── Choose the smallest test
│ │ │ │ ├── Hypothesis review
│ │ │ │ └── Update the model
│ │ │ ├── Building an asset inventory
│ │ │ │ ├── Normalize identifiers
│ │ │ │ ├── Supplied versus observed
│ │ │ │ ├── Identity review
│ │ │ │ └── Attach provenance
│ │ │ ├── Reading packet evidence
│ │ │ │ ├── Follow the conversation
│ │ │ │ ├── Understand absence
│ │ │ │ ├── Packet review
│ │ │ │ └── Capture with intent
│ │ │ ├── Ports, protocols, and state
│ │ │ │ ├── Ports are coordinates
│ │ │ │ ├── Read state in context
│ │ │ │ └── Expect nonstandard placement
│ │ │ ├── Service fingerprinting
│ │ │ │ ├── A banner is one witness
│ │ │ │ ├── Triangulate identity
│ │ │ │ ├── Fingerprint review
│ │ │ │ └── Report confidence
│ │ │ ├── Evidence that survives review
│ │ │ │ ├── Observation before interpretation
│ │ │ │ ├── Make reproduction cheap
│ │ │ │ ├── Evidence review
│ │ │ │ └── Minimize sensitive material
│ │ │ └── From signal to finding
│ │ │ ├── State the condition
│ │ │ ├── Connect condition to consequence
│ │ │ ├── Finding review
│ │ │ └── Recommend the control
│ │ │
│ │ ├── APPLICATION AND INFRASTRUCTURE
│ │ │ ├── Windows and Linux attack surfaces
│ │ │ │ ├── Model exposure by role
│ │ │ │ ├── Configuration beats folklore
│ │ │ │ └── Privilege is a graph
│ │ │ ├── Web application surface mapping
│ │ │ │ ├── Inventory behavior, not just routes
│ │ │ │ ├── Follow transformations
│ │ │ │ └── Use representative accounts
│ │ │ ├── Authentication and session security
│ │ │ ├── Authorization and tenant boundaries
│ │ │ ├── Injection classes and safe validation
│ │ │ ├── API and GraphQL assessment
│ │ │ ├── Enterprise identity and directory paths
│ │ │ ├── Cloud control-plane assessment
│ │ │ ├── Containers and software supply chain
│ │ │ └── Secrets and credential auditing
│ │ │
│ │ └── VALIDATION AND REMEDIATION
│ │ ├── Vulnerability validation and prioritization
│ │ ├── Impact demonstration, cleanup, and retest
│ │ ├── Linux privilege paths and proof
│ │ │ ├── Effective identity
│ │ │ ├── Controlling edges
│ │ │ ├── Safe validation
│ │ │ └── Path removal
│ │ ├── Windows privilege paths and service control
│ │ │ ├── Token authority
│ │ │ ├── Service controls
│ │ │ ├── Scheduled execution
│ │ │ └── Descriptor proof
│ │ ├── Active Directory control graphs
│ │ ├── Kerberos tickets and trust decisions
│ │ ├── Segmentation and pivot-path analysis
│ │ ├── SSRF and internal trust boundaries
│ │ ├── OAuth and OIDC flow validation
│ │ └── CI/CD identity and provenance chains
│
│ ├── WEB-201
│ │ └── WEB & API SECURITY ENGINEERING
│ │ ├── HTTP transactions as evidence
│ │ ├── Stateful attack-surface mapping
│ │ ├── Cross-site scripting by output context
│ │ ├── DOM dataflow and client-side sinks
│ │ ├── CSRF and request authority
│ │ ├── CORS origin decisions
│ │ ├── CSP and browser containment
│ │ ├── SQL injection and query structure
│ │ ├── NoSQL operator injection
│ │ ├── Command injection and process boundaries
│ │ ├── Path traversal and canonicalization
│ │ ├── File-upload trust pipelines
│ │ ├── XXE and parser capabilities
│ │ ├── Server-side template injection
│ │ ├── Deserialization and type trust
│ │ ├── SSRF and destination control
│ │ ├── Authentication lifecycle failures
│ │ ├── Session rotation and revocation
│ │ ├── Object authorization and BOLA
│ │ ├── JWT verification and key selection
│ │ ├── OAuth redirect and state binding
│ │ ├── GraphQL field authorization
│ │ ├── Business-logic invariants
│ │ ├── Race conditions and atomicity
│ │ ├── HTTP request framing and desynchronization
│ │ ├── Cache keys, poisoning, and deception
│ │ └── API resource and abuse controls
│ │ └── Every lesson:
│ │ ├── Model the trust decision
│ │ ├── Hold the boundary constant
│ │ ├── Build discriminating evidence
│ │ ├── Execute a sealed scenario
│ │ ├── Submit an artifact
│ │ └── Repair and retest
│
│ └── ENTERPRISE FORGE
│ │
│ ├── AD-301 — WINDOWS & ACTIVE DIRECTORY OPERATIONS
│ │ ├── Directory topology and trust mapping
│ │ ├── LDAP evidence and directory queries
│ │ ├── Kerberos ticket flow and service identity
│ │ ├── Directory ACL and control edges
│ │ ├── Group Policy scope and precedence
│ │ ├── Windows service identities
│ │ ├── Kerberos delegation boundaries
│ │ ├── Certificate Services trust
│ │ ├── Local administrator pathways
│ │ ├── Administrative tiering and protected identities
│ │ ├── Directory attack telemetry
│ │ └── AD path remediation and retest
│ │
│ ├── CLD-301 — CLOUD SECURITY ENGINEERING
│ │ ├── Cloud account and resource inventory
│ │ ├── IAM policy evaluation
│ │ ├── Role and workload trust
│ │ ├── Object storage exposure
│ │ ├── Cloud network control paths
│ │ ├── Workload metadata boundaries
│ │ ├── Key policy and cryptographic authority
│ │ ├── Serverless event trust
│ │ ├── Cloud audit evidence
│ │ ├── Managed container identity
│ │ ├── Organization guardrails
│ │ └── Cloud remediation and retest
│ │
│ ├── DET-301 — DETECTION ENGINEERING & INCIDENT ANALYSIS
│ │ ├── Telemetry contracts and coverage
│ │ ├── Detection hypotheses
│ │ ├── Process-tree reasoning
│ │ ├── Network and endpoint joins
│ │ ├── Identity behavior analytics
│ │ ├── Portable detection logic
│ │ ├── Threshold and sequence tuning
│ │ ├── Alert triage decisions
│ │ ├── Incident timeline construction
│ │ ├── Containment decision engineering
│ │ ├── Detection validation
│ │ └── Post-incident control closure
│ │
│ ├── LNX-301 — LINUX PRIVILEGE & HOST SECURITY
│ │ ├── Linux host evidence collection
│ │ ├── Sudo policy semantics
│ │ ├── Setuid and file capabilities
│ │ ├── Systemd trust boundaries
│ │ ├── Scheduled execution paths
│ │ ├── Container-to-host boundaries
│ │ ├── Kernel exposure triage
│ │ ├── Linux secret locations
│ │ ├── Linux service exposure
│ │ ├── Mandatory access controls
│ │ ├── Persistence review
│ │ └── Linux remediation and retest
│ │
│ ├── K8S-301 — CONTAINERS & KUBERNETES SECURITY
│ │ ├── Image identity and trust
│ │ ├── Pod security boundaries
│ │ ├── Kubernetes RBAC evaluation
│ │ ├── Service account lifecycle
│ │ ├── Kubernetes network policy
│ │ ├── Cluster secret handling
│ │ ├── Admission control
│ │ ├── Node and runtime trust
│ │ ├── Cluster multitenancy
│ │ ├── Container runtime detection
│ │ ├── Deployment supply chain
│ │ └── Cluster remediation and retest
│ │
│ └── SUP-301 — SOFTWARE SUPPLY CHAIN DEFENSE
│ ├── Source and review trust
│ ├── Dependency graph analysis
│ ├── SBOM quality and coverage
│ ├── Build isolation and identity
│ ├── Provenance verification
│ ├── Artifact signing and verification
│ ├── Registry control planes
│ ├── Pipeline secret boundaries
│ ├── Build cache integrity
│ ├── Release integrity
│ ├── Dependency vulnerability response
│ └── Supply-chain remediation and retest
│
├── INTEL LIBRARY
│ ├── Threat modeling a real trust boundary
│ ├── DNS is evidence, not inventory
│ ├── TLS identity and certificate chains
│ ├── Linux process identity and privilege
│ ├── Windows identity paths without guesswork
│ ├── Effective cloud access in one trace
│ ├── Container boundaries that matter
│ ├── Software supply-chain proof
│ ├── Detection engineering from first principles
│ ├── Incident triage without destroying evidence
│ ├── Credential lifecycle and secret exposure
│ └── Reports that survive skeptical review
│
├── DRILL LIBRARY
│ ├── Linux privilege paths
│ ├── Windows authority graph
│ ├── Session security
│ ├── SSRF and egress boundaries
│ ├── Container control review
│ ├── Supply-chain verification
│ ├── Detection telemetry
│ └── Incident timeline
│
├── RANGE FABRIC
│ ├── Artifact Zero
│ ├── Broken Trust
│ ├── Enterprise Forge
│ ├── The Ghost Port
│ ├── Identity Citadel
│ ├── Night Shift
│ ├── Policy Collision
│ ├── Token Afterlife
│ └── Web Forge
│
│ └── Range mechanics
│ ├── Docker-contained target
│ ├── Operator container
│ ├── Synthetic identities
│ ├── Synthetic evidence
│ ├── Network containment
│ ├── No external target requirement
│ ├── Evidence submission command
│ ├── SHA-256 integrity records
│ ├── Scenario contract
│ └── Cleanup and retest
│
├── MISSION OS
│ ├── Scope & Safety
│ ├── Network Analysis
│ ├── Web & API
│ ├── Identity
│ ├── Cloud & Supply Chain
│ └── Evidence & Detection
│
│ ├── Penetration Tester route
│ ├── Web & API Specialist route
│ ├── Identity Security route
│ ├── Cloud Security route
│ ├── Detection & Response route
│ └── Security Engineer route
│
│ └── Flagship missions
│ ├── The Ghost Port
│ ├── Broken Trust
│ └── Night Shift
│
├── MASTERY GRID
│ ├── Network evidence
│ ├── Identity & trust
│ ├── Application security
│ ├── Host & platform
│ ├── Cloud & delivery
│ └── Evidence & reporting
│
├── PRINCIPAL CAPSTONES
│ ├── CAP-01 — Night Glass
│ │ └── Enterprise intrusion triage
│ ├── CAP-02 — Broken Orbit
│ │ └── Cloud control-plane compromise
│ └── CAP-03 — Red Ledger
│ └── Full-spectrum assessment closeout
│
├── LESSON ENGINE
│ ├── Lesson briefing
│ ├── Mental model
│ ├── Objectives
│ ├── Prerequisites
│ ├── Evidence workshop
│ ├── Practical case
│ ├── Guided execution steps
│ ├── Interactive decision review
│ ├── Knowledge check
│ ├── Artifact deliverable
│ ├── References
│ ├── Remediation recommendation
│ └── Negative retest
│
└── OPERATOR RECORD
├── Completed lessons
├── Lesson attempts
├── Practical scores
├── Drill attempts
├── Mission attempts
├── Enterprise lab attempts
├── Capstone attempts
├── XP
├── Level
├── Daily streak
├── Best streak
├── Achievements
├── Adaptive route
├── Domain mastery
├── Evidence history
└── Remediation recommendations
--- [In development] ---
┌────────────────────────────────────────────────────────────────────────────┐
│ CORE 02 // ADVANCED CYBER OPERATIONS │
│ Development preview. MAL-401 and EXP-401 depth content are being built and │
│ validated locally. Advanced tracks remain unavailable to students until │
│ their fixtures, containment checks, instructor keys, and runtime │
│ certification pass. │
└────────────────────────────────────────────────────────────────────────────┘
├── CORE-02 // ADVANCED CYBER OPERATIONS
│
├── MAL-401 // Malware Analysis & Reverse Engineering
│ ├── Static triage and provenance
│ ├── Portable Executable anatomy
│ ├── ELF anatomy and loader behavior
│ ├── x86-64 control flow
│ ├── Debugger-led behavioral proof
│ ├── Operating-system API reconstruction
│ ├── Packing and obfuscation analysis
│ ├── Persistence mechanism analysis
│ ├── Malware protocol reconstruction
│ ├── Process memory forensics
│ ├── Behavioral detection engineering
│ └── Reverse-engineering report and containment
│
├── EXP-401 // Exploit Development & Memory Safety
│ ├── Process memory and calling conventions
│ ├── Crash reproduction and minimization
│ ├── Stack corruption fundamentals
│ ├── Heap misuse and allocator behavior
│ ├── Integer and bounds failures
│ ├── Format-string interpretation
│ ├── DEP, ASLR, canaries and CFI
│ ├── Return-oriented control flow
│ ├── Coverage-guided fuzzing
│ ├── Sanitizers and compiler hardening
│ ├── Root-cause patch development
│ └── Coordinated vulnerability disclosure
│
├── MOB-401 // Mobile Application Security
│ ├── Android application and permission model
│ ├── iOS application and entitlement model
│ ├── Package and binary inspection
│ ├── Local storage and secret handling
│ ├── Components, deep links and IPC
│ ├── Mobile transport security
│ ├── Mobile authentication and session lifecycle
│ ├── WebViews and browser bridges
│ ├── Runtime instrumentation in a sealed emulator
│ ├── Application integrity and anti-tamper controls
│ ├── Telemetry, privacy and data minimization
│ └── Mobile remediation and retest
│
├── CRY-401 // Applied Cryptography & PKI
│ ├── Security properties of cryptographic primitives
│ ├── Entropy and random-number generation
│ ├── Hashes, MACs and password derivation
│ ├── Authenticated symmetric encryption
│ ├── Public-key encryption and signatures
│ ├── TLS 1.3 handshake analysis
│ ├── X.509 path construction and validation
│ ├── Enterprise PKI architecture
│ ├── Key storage, rotation and revocation
│ ├── Cryptographic protocol composition
│ ├── Timing and side-channel fundamentals
│ └── Cryptographic agility and migration
│
├── FOR-401 // Advanced Digital Forensics
│ ├── Forensic acquisition and validation
│ ├── File-system metadata and recovery
│ ├── Windows forensic artifacts
│ ├── Linux forensic artifacts
│ ├── Memory acquisition and analysis
│ ├── Browser and application artifacts
│ ├── Network forensic reconstruction
│ ├── Email and collaboration forensics
│ ├── Mobile forensic fundamentals
│ ├── Cloud control-plane forensics
│ ├── Anti-forensics and uncertainty
│ └── Integrated forensic case reporting
│
├── SOC-401 // SOC Engineering & Threat Hunting
│ ├── Telemetry architecture and coverage
│ ├── Event parsing and normalization
│ ├── SIEM pipeline engineering
│ ├── Detection-as-code lifecycle
│ ├── Hypothesis-driven threat hunting
│ ├── Endpoint investigation
│ ├── Network detection and analysis
│ ├── Identity threat detection
│ ├── Cloud threat detection
│ ├── Alert triage and case management
│ ├── SOC quality and detection metrics
│ └── Purple-team validation campaign
│
├── NET-401 // Network Defense Architecture
│ ├── Routing and forwarding trust
│ ├── Layer-2 security controls
│ ├── DNS architecture and security
│ ├── Address assignment and admission
│ ├── Stateful firewall policy engineering
│ ├── Proxies, gateways and egress control
│ ├── VPN and remote-access design
│ ├── Zero-trust network access
│ ├── Network intrusion detection
│ ├── IPv6 security operations
│ ├── Enterprise wireless security
│ └── Resilient network architecture
│
├── DEV-401 // Secure Software Engineering
│ ├── Security requirements and abuse cases
│ ├── Threat modeling and trust boundaries
│ ├── Evidence-led secure code review
│ ├── JavaScript and TypeScript security
│ ├── Python application security
│ ├── .NET application security
│ ├── Java application security
│ ├── Go and Rust security boundaries
│ ├── Secure API design
│ ├── Security unit and integration testing
│ ├── Secure delivery pipeline
│ └── Software security assurance case
│
├── CLD-401 // Multi-Cloud Security Architecture
│ ├── AWS Organizations and delegated administration
│ ├── Microsoft Entra and Azure control planes
│ ├── GCP organization and resource hierarchy
│ ├── Workforce and workload federation
│ ├── Multi-cloud network security
│ ├── Cloud data protection
│ ├── Serverless and event-driven security
│ ├── Managed container platform security
│ ├── Cloud secrets and key management
│ ├── Cloud audit and detection architecture
│ ├── Cloud recovery and ransomware resistance
│ └── Multi-cloud policy engineering
│
├── ICS-401 // OT, ICS & Embedded Security
│ ├── Safety, consequence and authorization
│ ├── Purdue model and industrial zones
│ ├── Industrial protocol analysis
│ ├── PLC logic and control integrity
│ ├── HMI and engineering workstation security
│ ├── Industrial remote access
│ ├── Passive OT monitoring
│ ├── Firmware acquisition and analysis
│ ├── Embedded interfaces and debug boundaries
│ ├── Industrial supply-chain trust
│ ├── OT incident response
│ └── Cyber-physical recovery validation
│
├── GRC-401 // Security Governance, Risk & Privacy Engineering
│ ├── Security governance and accountability
│ ├── Quantitative and qualitative risk analysis
│ ├── Control design and effectiveness
│ ├── Framework and regulatory mapping
│ ├── Privacy engineering and data lifecycle
│ ├── Third-party and supply-chain risk
│ ├── Risk acceptance and exceptions
│ ├── Security measurement and reporting
│ ├── Technical audit evidence
│ ├── Business continuity and resilience
│ ├── Executive incident and crisis governance
│ └── Security program assurance
│
└── HWR-401 // Hardware, Firmware & Side-Channel Security
├── Digital hardware security foundations
├── Secure boot and measured boot
├── Firmware formats and extraction
├── UART, JTAG and debug access
├── Flash storage and secret recovery boundaries
├── Firmware update security
├── TPM, secure elements and attestation
├── Fault-injection fundamentals
├── Timing side channels
├── Power and electromagnetic analysis
├── Hardware supply-chain assurance
└── Device hardening and validation