Resources

References and further reading

The course is self-contained, but these are the primary references used to classify and cross-check the campaign. External links open in a new context and are not endorsements.

Primary source

Monograph: Adversary Emulation

The course is adapted from the 239-page monograph byBhavesh M. Dhake. The online lessons are the structured edition of that work. The source document is not offered as a separate download from this site.

Source-to-lesson mapping is documented in the project repository so every section can be traced back to its origin.

MITRE ATT&CK techniques

Each module maps its lab to a technique. The links below go to the public ATT&CK pages.

Hidden IFRAME

T1189

ATT&CK 02

Use-After-Free (UAF)

T1203

ATT&CK 03

Send Implant Data

T1082

ATT&CK 04

Execute Shellcode

T1106

ATT&CK 05

Terminate Itself

T1070

ATT&CK 06

Injection Target

T1055

ATT&CK 07

Injection Content

T1055

ATT&CK 08

Resilience Mechanism

T1055

ATT&CK 09

Internal Communication (Named Pipe)

T1559

ATT&CK 10

External Communication (AES-256-GCM)

T1573.001

ATT&CK

Campaign reporting

3CX software supply-chain compromise

Google Cloud threat-intelligence analysis of the 3CX campaign, including the Trading Technologies watering hole and the trojanized installer.

Read the report

CVE-2022-0609

The Chrome use-after-free in the Animation component that the campaign exploited. The course models the primitive rather than reproducing a weaponized browser exploit.

View the NVD entry

Author

Bhavesh M. Dhake

Author of the source monograph.

GitHub LinkedIn

All research and demonstrations must be conducted in authorized, controlled environments. The course does not grant permission to test any third-party system.