Threat Hunting Workshop 18: Hunting for Credential Access - Level 2

Credential access is one of the most consequential phases of an intrusion where attackers move from a foothold to stolen identities that unlock access across an environment. This Level 2 workshop, led by Lee Archinal, Principal Threat Hunt Account Manager at Intel 471, is designed to make you a stronger threat hunter through a fully interactive, hands-on experience.

What to Expect

Designed for threat hunters looking to deepen their skills, this session will have you following along every step of the way, working through real credential access scenarios using real data we provide. This is not a lecture.

What You'll Do

Analyze authentication artifacts, memory access patterns, process behavior, and tool artifacts to identify where credential theft occurred, how it was executed, and what access it enabled, all guided by threat intelligence to connect findings to adversary intent.

What You'll Walk Away With

• A repeatable framework for hunting credential access behaviors in production environments
• Hands-on experience that directly strengthens your skills as a threat hunter
• Access to supporting reference materials after the session
• The opportunity to earn your "Threat Hunting - Credential Access (Level 2)" badge by completing a final challenge after the workshop

Looking to brush up on the fundamentals? The Level 1 Credential Access Workshop is available as an optional resource.

This is your opportunity to sharpen your investigative skills alongside an expert and leave better prepared to detect and respond to one of the most critical attack techniques in the threat landscape.