Trainer information
Security Researcher, Trainer & Speaker
Uriel Kosayev is a cybersecurity researcher and reverse engineer with over a decade of experience spanning offensive security, malware analysis, and incident response. He co-founded TrainSec Academy and authored two books: Antivirus Bypass Techniques (8,000+ copies sold) and MAoS – Malware Analysis on Steroids (2025). He has contributed vulnerability research to the MITRE ATT&CK framework and published academic white papers on malware detection and memory-based threats.
“I want to recommend Uriel Kosayev as a quality professional security researcher and lecturer who knows how to guide his students, give the right word, and push them to success. I had the pleasure of being his student.”
Threat Researcher and Orion Malware Research Team Leader at Cynet
“The one and only master, thank you! Your knowledge and your passion for Cyber make you a great teacher!!!”
“Uriel is a great lecturer and person not only because of his knowledge in security research, offensive security, and Malware Analysis but also because of the passion that he provided me as a student to keep asking questions and research by myself.”
“I want to say that Uriel Kosayev is one of the best researchers in the industry, with a lot of experience in the field of investigations and reverse engineering, I learned a lot from him. In addition, he has one of the best books on the market that teaches anti-virus bypass methods. I recommend everyone to acquire knowledge from Uriel!”
“Uriel is one of the best Cybersecurity trainers among all the people I have ever met. A rare combination of professionalism and high-quality delivery excellent and creative ways he delivers the material. On top of that, if you will ever be a student in his class, I can guarantee you that he will explain to you till you finally understand the learned material. A great lecturer and mentor!”
“I highly recommend Uriel as a Cybersecurity Specialist. I had the privilege of participating in his training session – it was an exceptional experience! Uriel delivered practical insights that significantly enhanced my and my Team's knowledge and skills in the field. I am grateful for the opportunity to learn from Uriel and would eagerly participate in any future training sessions organized by him.”
The loop real detection engineers run in production.
Every attack-and-defense module in this course follows the same five-step cycle. It’s the single most important habit the course teaches, because it’s how real detection engineering work is done:
Simulate – Execute the attacker technique yourself in a controlled lab, so you know exactly what happened and when.
Investigate – Follow the technique through the telemetry it produced. Discover which data sources saw it, and which were blind.
Detect – Write the detection rule against the durable artifact the attack leaves behind, not against the tool that created it.
Tune – Measure alert volume, exclude legitimate activity, and accept that every exclusion is a new blind spot.
Validate – Re-simulate the attack to prove the rule fires. Then ask how you’d bypass your own rule, and close that gap.
This isn’t a course about recognizing attacks. It’s a course about owning the detections that stop them.
In this course slide deck, you will find all materials both presented in the videos and many practical labs for you to become more practically knowledgeable.
So have fun, practice a lot and remember to always say thanks to the one above for everything good and challenging in life, because challenges are what build us 😀
Good luck, and with all my heart, enjoy the course!
An orientation to how a EDR, XDR and SIEM correlates telemetry from every source into a single attack picture, and the five-step methodology (simulate, investigate, detect, tune, validate) this entire course is built around.
Builds the offensive vocabulary and mental models, hacker types, the CIA and DAD triads, the Cyber Kill Chain, and threat actor taxonomy, that every later module assumes you already have, using real incident case studies like Kaseya, Colonial Pipeline, and WannaCry.
Walks through reconnaissance, port mapping, AV/EDR bypass reasoning, phishing infrastructure, and SSL stripping from the attacker’s perspective, so you know exactly what footprint each technique leaves for a defender to catch.
Covers malware classification and sandbox evasion, and how to read the MITRE ATT&CK framework properly, then puts it into practice by reconstructing the Emotet infection chain stage by stage.
Hands-on hardening and mitigation work, from VLAN hopping and DHCP/ARP spoofing to LSASS credential dumping and DNS zone transfer attacks, each paired with the concrete Windows and Linux controls that stop it.
The full incident response lifecycle, from preparation and volatile evidence acquisition to eradication and lessons learned, plus a hypothesis-driven threat hunting process that goes beyond static IOCs.
Deep dive into Windows Event Viewer and the Security log, reading Event ID 4624 and 4625 field by field to recognize password spraying, log clearing, and attacker-style domain discovery straight from the log data.
Build Sysmon configurations from scratch and write detection rules across every core event type, process creation, DNS queries, registry persistence, image load, and process injection, then learn to reason about how your own rules could be bypassed.
Clarifies what actually separates AV, EDR, XDR, and SIEM, then walks through deploying and hardening Elastic Defend end to end, including anti-tampering and telemetry sanity checks.
The first full simulate-investigate-detect cycles of the course. RDP, PsExec, and WinRM attacks executed against the lab, then correlated across Windows Security events and Elastic Defend telemetry into KQL detection rules you author yourself.
Simulates the domain enumeration an attacker runs immediately after gaining a foothold, nltest, net user /domain, and net.exe, then builds resilient, wildcard-based Elastic rules that don’t overfit to a single parent process.
Covers encoded PowerShell, WMI process creation as an EDR blind spot, and how to pivot on process ancestry to build behavioral rules that survive an attacker swapping their tooling.
Plants and detects the three classic Windows persistence mechanisms, registry Run keys, services, and Startup folder shortcuts, then dumps LSASS credentials via comsvcs.dll and builds the Elastic rules that catch each technique.
Explores the telemetry footprint of process injection techniques like CreateRemoteThread and process hollowing, then shows how to use the Elastic Security AI assistant to draft and validate detection rules without trusting it blindly.
Closes the course with a repeatable alert triage workflow, the tuning philosophy that separates a resilient detection from a brittle one, and independent practice labs with no answer key.
A standalone reference module on the Windows filesystem and registry locations attackers use most, staging directories, Prefetch, shellbags, USB history, turned into detection ideas you can act on immediately.