DaemonCore Curriculum
Complete full-spectrum security engineering syllabus and training pathways.
DAEMONCORE ACADEMY
│
├── PLATFORM CONTENT
│ ├── 8 curriculum pathways
│ ├── 127 lessons
│ ├── 505 guided sections
│ ├── 7,381 estimated minutes
│ ├── 123+ hours of instruction
│ ├── 12 Intel articles
│ ├── 8 repeatable drill sets
│ ├── 9 sealed range packs
│ ├── 70 specialist range conditions
│ ├── 3 capstones
│ ├── 6 adaptive Mission OS domains
│ ├── 6 role-based learning routes
│ ├── Local progress record
│ ├── Lesson scoring
│ ├── Practical evidence artifacts
│ ├── Testing Mode
│ ├── Mastery Grid
│ ├── XP and streak system
│ ├── Achievement system
│ └── Adaptive remediation
│
├── CURRICULUM PATHWAYS
│
│ ├── CORE-01
│ │ └── FULL-SPECTRUM SECURITY ASSESSMENT
│ │ │
│ │ ├── FOUNDATIONS
│ │ │ ├── Scope and rules of engagement
│ │ │ │ ├── Authorization is a technical input
│ │ │ │ ├── Build a stop condition
│ │ │ │ ├── Boundary review
│ │ │ │ └── Keep the boundary visible
│ │ │ ├── Reconnaissance as a hypothesis loop
│ │ │ │ ├── Questions before commands
│ │ │ │ ├── Choose the smallest test
│ │ │ │ ├── Hypothesis review
│ │ │ │ └── Update the model
│ │ │ ├── Building an asset inventory
│ │ │ │ ├── Normalize identifiers
│ │ │ │ ├── Supplied versus observed
│ │ │ │ ├── Identity review
│ │ │ │ └── Attach provenance
│ │ │ ├── Reading packet evidence
│ │ │ │ ├── Follow the conversation
│ │ │ │ ├── Understand absence
│ │ │ │ ├── Packet review
│ │ │ │ └── Capture with intent
│ │ │ ├── Ports, protocols, and state
│ │ │ │ ├── Ports are coordinates
│ │ │ │ ├── Read state in context
│ │ │ │ └── Expect nonstandard placement
│ │ │ ├── Service fingerprinting
│ │ │ │ ├── A banner is one witness
│ │ │ │ ├── Triangulate identity
│ │ │ │ ├── Fingerprint review
│ │ │ │ └── Report confidence
│ │ │ ├── Evidence that survives review
│ │ │ │ ├── Observation before interpretation
│ │ │ │ ├── Make reproduction cheap
│ │ │ │ ├── Evidence review
│ │ │ │ └── Minimize sensitive material
│ │ │ └── From signal to finding
│ │ │ ├── State the condition
│ │ │ ├── Connect condition to consequence
│ │ │ ├── Finding review
│ │ │ └── Recommend the control
│ │ │
│ │ ├── APPLICATION AND INFRASTRUCTURE
│ │ │ ├── Windows and Linux attack surfaces
│ │ │ │ ├── Model exposure by role
│ │ │ │ ├── Configuration beats folklore
│ │ │ │ └── Privilege is a graph
│ │ │ ├── Web application surface mapping
│ │ │ │ ├── Inventory behavior, not just routes
│ │ │ │ ├── Follow transformations
│ │ │ │ └── Use representative accounts
│ │ │ ├── Authentication and session security
│ │ │ ├── Authorization and tenant boundaries
│ │ │ ├── Injection classes and safe validation
│ │ │ ├── API and GraphQL assessment
│ │ │ ├── Enterprise identity and directory paths
│ │ │ ├── Cloud control-plane assessment
│ │ │ ├── Containers and software supply chain
│ │ │ └── Secrets and credential auditing
│ │ │
│ │ └── VALIDATION AND REMEDIATION
│ │ ├── Vulnerability validation and prioritization
│ │ ├── Impact demonstration, cleanup, and retest
│ │ ├── Linux privilege paths and proof
│ │ │ ├── Effective identity
│ │ │ ├── Controlling edges
│ │ │ ├── Safe validation
│ │ │ └── Path removal
│ │ ├── Windows privilege paths and service control
│ │ │ ├── Token authority
│ │ │ ├── Service controls
│ │ │ ├── Scheduled execution
│ │ │ └── Descriptor proof
│ │ ├── Active Directory control graphs
│ │ ├── Kerberos tickets and trust decisions
│ │ ├── Segmentation and pivot-path analysis
│ │ ├── SSRF and internal trust boundaries
│ │ ├── OAuth and OIDC flow validation
│ │ └── CI/CD identity and provenance chains
│
│ ├── WEB-201
│ │ └── WEB & API SECURITY ENGINEERING
│ │ ├── HTTP transactions as evidence
│ │ ├── Stateful attack-surface mapping
│ │ ├── Cross-site scripting by output context
│ │ ├── DOM dataflow and client-side sinks
│ │ ├── CSRF and request authority
│ │ ├── CORS origin decisions
│ │ ├── CSP and browser containment
│ │ ├── SQL injection and query structure
│ │ ├── NoSQL operator injection
│ │ ├── Command injection and process boundaries
│ │ ├── Path traversal and canonicalization
│ │ ├── File-upload trust pipelines
│ │ ├── XXE and parser capabilities
│ │ ├── Server-side template injection
│ │ ├── Deserialization and type trust
│ │ ├── SSRF and destination control
│ │ ├── Authentication lifecycle failures
│ │ ├── Session rotation and revocation
│ │ ├── Object authorization and BOLA
│ │ ├── JWT verification and key selection
│ │ ├── OAuth redirect and state binding
│ │ ├── GraphQL field authorization
│ │ ├── Business-logic invariants
│ │ ├── Race conditions and atomicity
│ │ ├── HTTP request framing and desynchronization
│ │ ├── Cache keys, poisoning, and deception
│ │ └── API resource and abuse controls
│ │ └── Every lesson:
│ │ ├── Model the trust decision
│ │ ├── Hold the boundary constant
│ │ ├── Build discriminating evidence
│ │ ├── Execute a sealed scenario
│ │ ├── Submit an artifact
│ │ └── Repair and retest
│
│ └── ENTERPRISE FORGE
│ │
│ ├── AD-301 — WINDOWS & ACTIVE DIRECTORY OPERATIONS
│ │ ├── Directory topology and trust mapping
│ │ ├── LDAP evidence and directory queries
│ │ ├── Kerberos ticket flow and service identity
│ │ ├── Directory ACL and control edges
│ │ ├── Group Policy scope and precedence
│ │ ├── Windows service identities
│ │ ├── Kerberos delegation boundaries
│ │ ├── Certificate Services trust
│ │ ├── Local administrator pathways
│ │ ├── Administrative tiering and protected identities
│ │ ├── Directory attack telemetry
│ │ └── AD path remediation and retest
│ │
│ ├── CLD-301 — CLOUD SECURITY ENGINEERING
│ │ ├── Cloud account and resource inventory
│ │ ├── IAM policy evaluation
│ │ ├── Role and workload trust
│ │ ├── Object storage exposure
│ │ ├── Cloud network control paths
│ │ ├── Workload metadata boundaries
│ │ ├── Key policy and cryptographic authority
│ │ ├── Serverless event trust
│ │ ├── Cloud audit evidence
│ │ ├── Managed container identity
│ │ ├── Organization guardrails
│ │ └── Cloud remediation and retest
│ │
│ ├── DET-301 — DETECTION ENGINEERING & INCIDENT ANALYSIS
│ │ ├── Telemetry contracts and coverage
│ │ ├── Detection hypotheses
│ │ ├── Process-tree reasoning
│ │ ├── Network and endpoint joins
│ │ ├── Identity behavior analytics
│ │ ├── Portable detection logic
│ │ ├── Threshold and sequence tuning
│ │ ├── Alert triage decisions
│ │ ├── Incident timeline construction
│ │ ├── Containment decision engineering
│ │ ├── Detection validation
│ │ └── Post-incident control closure
│ │
│ ├── LNX-301 — LINUX PRIVILEGE & HOST SECURITY
│ │ ├── Linux host evidence collection
│ │ ├── Sudo policy semantics
│ │ ├── Setuid and file capabilities
│ │ ├── Systemd trust boundaries
│ │ ├── Scheduled execution paths
│ │ ├── Container-to-host boundaries
│ │ ├── Kernel exposure triage
│ │ ├── Linux secret locations
│ │ ├── Linux service exposure
│ │ ├── Mandatory access controls
│ │ ├── Persistence review
│ │ └── Linux remediation and retest
│ │
│ ├── K8S-301 — CONTAINERS & KUBERNETES SECURITY
│ │ ├── Image identity and trust
│ │ ├── Pod security boundaries
│ │ ├── Kubernetes RBAC evaluation
│ │ ├── Service account lifecycle
│ │ ├── Kubernetes network policy
│ │ ├── Cluster secret handling
│ │ ├── Admission control
│ │ ├── Node and runtime trust
│ │ ├── Cluster multitenancy
│ │ ├── Container runtime detection
│ │ ├── Deployment supply chain
│ │ └── Cluster remediation and retest
│ │
│ └── SUP-301 — SOFTWARE SUPPLY CHAIN DEFENSE
│ ├── Source and review trust
│ ├── Dependency graph analysis
│ ├── SBOM quality and coverage
│ ├── Build isolation and identity
│ ├── Provenance verification
│ ├── Artifact signing and verification
│ ├── Registry control planes
│ ├── Pipeline secret boundaries
│ ├── Build cache integrity
│ ├── Release integrity
│ ├── Dependency vulnerability response
│ └── Supply-chain remediation and retest
│
├── INTEL LIBRARY
│ ├── Threat modeling a real trust boundary
│ ├── DNS is evidence, not inventory
│ ├── TLS identity and certificate chains
│ ├── Linux process identity and privilege
│ ├── Windows identity paths without guesswork
│ ├── Effective cloud access in one trace
│ ├── Container boundaries that matter
│ ├── Software supply-chain proof
│ ├── Detection engineering from first principles
│ ├── Incident triage without destroying evidence
│ ├── Credential lifecycle and secret exposure
│ └── Reports that survive skeptical review
│
├── DRILL LIBRARY
│ ├── Linux privilege paths
│ ├── Windows authority graph
│ ├── Session security
│ ├── SSRF and egress boundaries
│ ├── Container control review
│ ├── Supply-chain verification
│ ├── Detection telemetry
│ └── Incident timeline
│
├── RANGE FABRIC
│ ├── Artifact Zero
│ ├── Broken Trust
│ ├── Enterprise Forge
│ ├── The Ghost Port
│ ├── Identity Citadel
│ ├── Night Shift
│ ├── Policy Collision
│ ├── Token Afterlife
│ └── Web Forge
│
│ └── Range mechanics
│ ├── Docker-contained target
│ ├── Operator container
│ ├── Synthetic identities
│ ├── Synthetic evidence
│ ├── Network containment
│ ├── No external target requirement
│ ├── Evidence submission command
│ ├── SHA-256 integrity records
│ ├── Scenario contract
│ └── Cleanup and retest
│
├── MISSION OS
│ ├── Scope & Safety
│ ├── Network Analysis
│ ├── Web & API
│ ├── Identity
│ ├── Cloud & Supply Chain
│ └── Evidence & Detection
│
│ ├── Penetration Tester route
│ ├── Web & API Specialist route
│ ├── Identity Security route
│ ├── Cloud Security route
│ ├── Detection & Response route
│ └── Security Engineer route
│
│ └── Flagship missions
│ ├── The Ghost Port
│ ├── Broken Trust
│ └── Night Shift
│
├── MASTERY GRID
│ ├── Network evidence
│ ├── Identity & trust
│ ├── Application security
│ ├── Host & platform
│ ├── Cloud & delivery
│ └── Evidence & reporting
│
├── PRINCIPAL CAPSTONES
│ ├── CAP-01 — Night Glass
│ │ └── Enterprise intrusion triage
│ ├── CAP-02 — Broken Orbit
│ │ └── Cloud control-plane compromise
│ └── CAP-03 — Red Ledger
│ └── Full-spectrum assessment closeout
│
├── LESSON ENGINE
│ ├── Lesson briefing
│ ├── Mental model
│ ├── Objectives
│ ├── Prerequisites
│ ├── Evidence workshop
│ ├── Practical case
│ ├── Guided execution steps
│ ├── Interactive decision review
│ ├── Knowledge check
│ ├── Artifact deliverable
│ ├── References
│ ├── Remediation recommendation
│ └── Negative retest
│
└── OPERATOR RECORD
├── Completed lessons
├── Lesson attempts
├── Practical scores
├── Drill attempts
├── Mission attempts
├── Enterprise lab attempts
├── Capstone attempts
├── XP
├── Level
├── Daily streak
├── Best streak
├── Achievements
├── Adaptive route
├── Domain mastery
├── Evidence history
└── Remediation recommendations
--- [COMING Q1 2027] ---
├── CORE-02
│ └── Advanced Security Operations
│ ├── Advanced attack-path chaining
│ ├── Purple-team validation
│ ├── Complex identity and cloud compromise
│ ├── Detection evasion and control testing
│ ├── Incident command
│ ├── Enterprise remediation
│ └── Advanced capstone