002_Curriculum Design

This document is meant to be used as a reference for overall objectives, learning resources, and labs for bringing a team up to speed. This will be designed as if an organization is starting a team from zero, and other than required inter-dependencies, all objectives will be as self contained as possible.

Domains

Each domain covers a different overarching topic, while some may be inter-related, ultimately each domain covers topics for each team function (ie. Windows, Linux, etc.). Each domain is designed to be taught independently of one another (assuming the required basics are understood).

Overview:

Domain 1.0: Network & Perimeter Security
1.1 Edge Firewall architecture
1.2 Network Address Translation (NAT) & Interface Routing
1.3 Network Traffic Analysis & Inspection
1.4 Network Access Control & Segmentation

Domain 2.0: Windows & Active Directory
2.1 Active Directory Domain Services Hardening
2.2 Group Policy Object (GPO) Security Policy Deployment
2.3 Authentication & Privilege Auditing
2.4 Windows Threat Hunting & Persistence Identification
2.5 Log Telemetry & Event Analysis

Domain 3.0: Linux
3.1 Account & Privilege Management
3.2 Service & Daemon Management
3.3 Kernel & Subsystem Security
3.4 Linux Persistence Mechanics & Privilege Escalation Mitigation
3.5 File System Integrity & Auditing / Log Analysis

Domain 4.0: Service Hardening & Configuration
4.1 Web Server Hardening
4.2 Database Security
4.3 Infrastructure Services
4.4 Web Application Security & CMS Hardening

Domain 5.0: Incident Response & Threat Hunting
5.1 Incident Response Lifecycle
5.2 Memory & Process Analysis
5.3 Threat Hunting Mechanics
5.4 Incident Reporting

Domain 6.0: Injects & Operations Management
6.1 Business Inject Triage & Workflows
6.2 Technical Writing & Policy Drafting
6.3 Regulatory Compliance & Audit Mapping
6.4 Team Dynamics & Crisis Communications

Preparation Schedule

Assuming a start date of October 12th, 2026 and an initial qualifying round of January 17th, 2027.

Phase	Weeks included	Description
1	1-5	Universal Fundementals
2	6-9	Specialization Tracks
3	10-12	Archetype Drills
4	13-14	Full Competition Simulations

Phase 1:

Week	Topic(s)	Labs	Async work	Domains
1	Intro to CCDC rules, Team Dynamics, Scoring engine, "First 15 Minutes"	Triage compromised VM, Account Audits, User + Password Management, apply baseline firewalls	Read CCDC team prep, Create a "First 15 minutes" card during lecture/lab
2	Firewall fundementals, default ingress/egress policies, NAT, basic packet capturing.	Edge firewall rules, maintaining scoring ports. Packet captures and analysis for creds and reverse shell traffic	Watch/Read on firewall rule creation, Create standard port chart for core network services (CCDC specific?)	1.1, 1.2, 1.3, 1.4
3	Linux systems administration (user/group audits, systemd service management, crontab, ufc/iptables)	Audit and harden Ubuntu or Rocky host. ID backdoors, and apply hardening techniques.	Read about Linux privilege escalation and persistence. Read linux administration chapters and create a bash script to find modified SUID files + active cron tasks	3.1, 3.2, 3.3, 3.4
4	Windows local account audits, Active Directory basisc, GPO baselines, Windows Defender enforcement, and legacy protocols	Harden a Windows Server + DC. Audit domain admins, enforce password complexity	Read Active Directory triage, write a PowerShell script to audit local admins and accounts with non-expiring passwords.	2.1, 2.2, 2.3, 2.4
5	Maintaining service uptime (web + db stacks), centralize logging with Wazuh agents	Maintain up-time and scoring checks while deploying a Wazuh agent + server Aptitude Eval + Role assignments	Read scoring documentation and rules. Read Wazuh documentation	4.1, 4.2, 5.2, 6.4

Phase 2 Reading & Async work:

Week	Host Team	Network & Threat Hunting Team	Operations Team
6	Read Active Directory Kerberos attack documentation and Nginx/MySQL binding hardening guides	Review Suricata/Snort signature writing syntax and OPNsense dynamic alias blocking documentation	Review NIST SP 800-53 and PCI-DSS control families related to password complexity and access control
7	Read technical breakdowns of persistence mechanisms (Windows Scheduled Tasks, startup folders, Linux systemd timers, backdoored PAM modules)	Review Wazuh File Integrity Monitoring (FIM) configuration documentation and TShark display filters for HTTP/DNS anomalies	Review official CCDC Incident Report (IR) rubrics and sample submissions
8	Study common PHP, ASPX, and JSP web shell signatures, execution functions (`system`, `exec`, `passthru`), and MS SQL `xp_cmdshell` risk vectors	Review stateful firewall session termination and host-isolation ACL workflows	Read executive communication frameworks for delivering high-stress operational briefings
9	Review Active Directory forest trust security and Kerberos attack vectors	Read on systems forensics and network forensics	Read texts on managing a SOC

Week	Host Team	Network & Threat Hunting Team	Operations Team
6	Write a PowerShell snippet to audit Service Principal Names (SPNs) and a Bash snippet to bind MySQL strictly to 127.0.0.1	Draft 3 custom Suricata detection rules for common C2 user-agents and port scans	Create a 1-page standardized policy response template for compliance-focused business injects
7	Write a PowerShell/Bash script to query and export all scheduled execution tasks and non-standard systemd service units	Draft custom Wazuh XML rule blocks to alert on /etc/pam.d/ and web root directory modifications	Build and publish the team's master Markdown Incident Report template to the central Git repository
8	Write a grep/PowerShell regex script to scan web directories for dangerous execution functions	Create a 1-page emergency firewall playbook detailing step-by-step commands to isolate a single host without dropping scored gateway traffic	Draft a 2-minute oral briefing script and outline a slide-deck structure for White Team executive site visits
9	Update team AD and Ansible playbooks	Create a write-up of forensics lab or network forensics lab	Draft an incident report and postmortem analysis of team performance

Phase 2 Labs:

Week	Host Team	Network & Threat Hunting Team	Operations Team
6	Block Kerberoasting/AS-REP roasting, audit GPOs. Secure Nginx/Apache & MySQL bindings. (2.2, 2.3, 4.1, 4.2)	Deploy Suricata/Snort signatures on OPNsense, construct dynamic IP blocking scripts (1.4)	Master 30-minute inject workflows, map controls to NIST SP 800-53 and PCI-DSS (6.1, 6.2)
7	Locate/delete scheduled tasks, backdoored systemd units, modified PAM modules, and hidden startup scripts (2.4, 3.2)	Build custom Wazuh FIM rules, analyze packet streams for out-of-band C2 channels (5.2, 5.3)	Build standard CCDC Incident Report (IR) templates and evidence logging pipelines (5.4)
8	Hunt PHP/ASPX web shells in CMS roots, disable hazardous DB procedures	Apply ACL isolation for compromised hosts without dropping scored traffic	Conduct oral executive presentations and practice White Team audit interactions
9	Archetype Drill I	Archetype Drill I	Archetype Drill I

Phase 3:

Resource List

Book List

DOMAIN 1.0: NETWORK INFRASTRUCTURE, FIREWALLS, & PERIMETER SECURITY

Practical Packet Analysis (3rd Edition) | Chris Sanders | 978-1593278021
Network Forensics: Tracking Hackers Through Cyberspace | Sherri Davidoff & Jonathan Ham | 978-0132564717
The Practice of Network Security Monitoring | Richard Bejtlich | 978-1593275099
Linux Firewalls (4th Edition) | Steve Suehring | 978-0134000015
Network Security Assessment (3rd Edition) | Chris McNab | 978-1491911051

DOMAIN 2.0: WINDOWS SYSTEMS ADMINISTRATION & ACTIVE DIRECTORY SECURITY

Mastering Active Directory (3rd Edition) | Dishan Francis | 978-1801070393
Windows Sysinternals Administrator's Reference | Mark Russinovich & Aaron Margosis | 978-0735656727
Mastering Windows Server 2022 (3rd Edition) | Jordan Krause | 978-1800569195
Active Directory Cookbook (4th Edition) | Laura E. Hunter & Robbie Allen | 978-1449333065
PowerShell for Cybersecurity | Brian Morris | 978-1789808384

DOMAIN 3.0: LINUX / UNIX SYSTEMS ADMINISTRATION & HARDENING

UNIX and Linux System Administration Handbook (5th Edition) | Evi Nemeth et al. | 978-0134277554
Linux Hardening in Action | Alex Antle | 978-1617298318
How Linux Works: What Every Superuser Should Know (3rd Ed) | Brian Ward | 978-1718500402
Linux Server Security (2nd Edition) | Michael Bauer | 978-0596009229
Practical Linux System Administration | Kenneth Hess | 978-1492091424

DOMAIN 4.0: SCORED SERVICES HARDENING & WEB APPLICATION SECURITY

The Web Application Hacker's Handbook (2nd Edition) | Dafydd Stuttard & Marcus Pinto | 978-1118026472
Web Security for Developers | Malcolm McDonald | 978-1718500648
High Performance MySQL (4th Edition) | Silvia Botros & Jeremy Tinley | 978-1492080510
SQL Injection Attacks and Defense (2nd Edition) | Justin Clarke | 978-1597499637
Apache Security | Ivan Ristic | 978-0596007249

DOMAIN 5.0: INCIDENT RESPONSE, PERSISTENCE ERADICATION, & THREAT HUNTING

Blue Team Handbook: Incident Response Edition (2nd Edition) | Don Murdoch | 978-1500734756
Applied Incident Response | Steve Anson | 978-1119560265
Practical Malware Analysis | Michael Sikorski & Andrew Honig | 978-1593272906
Incident Response & Computer Forensics (3rd Edition) | Jason T. Luttgens et al. | 978-0071798686
Crafting the InfoSec Playbook | Matthew Pascucci & Jeff Bolke | 978-1491904985

DOMAIN 6.0: BUSINESS INJECTS, POLICY CREATION, & OPERATIONS MANAGEMENT

Cybersecurity Blue Team Toolkit | Tari Schreider | 978-1119436928
Security Policies and Implementation Issues (3rd Edition) | Robert Johnson | 978-1284196306
Information Security Policies, Procedures, and Standards | Thomas R. Peltier | 978-1466588011
Security Operations Center: Building, Operating, and Maintaining| Joseph Muniz et al. | 978-1587144493
Defensive Security Handbook | Lee Brotherston & Amanda Berlin | 978-1491960387

Web Resources

Tooling

Team Composition

Team Leader / Operations Lead (1 Student): Oversees team coordination, time management, high-level tactical decisions, crisis prioritization, and communications with competition officials (White Team).
Inject Writer & Documentation Manager (1 Student): Dedicated to drafting, formatting, and submitting all business inject responses, executive summaries, compliance policies, and incident reports.
Windows Systems Administrators (2 Students): Responsible for securing Windows Server environments, Active Directory Domain Services (AD DS), Group Policy Objects (GPOs), Kerberos/LDAP authentication, and IIS/MSSQL services.
Linux / Unix Systems Administrators (2 Students): Tasked with hardening Linux distributions (RHEL/CentOS, Ubuntu/Debian, FreeBSD), systemd/init services, PAM, SSH, web stacks (Apache, Nginx), databases (MySQL, PostgreSQL), and mail services.
Network & Firewall Engineer (1 Student): Manages edge firewalls (pfSense, Palo Alto PAN-OS, Fortinet), routing tables, NAT policies, VLAN segmentation, and perimeter traffic inspection.
Incident Responder & Threat Hunter (1 Student): Monitors network traffic, analyzes host log telemetry, investigates unauthorized persistence, coordinates cross-system containment, and packages evidence for incident reports.