Daemoncore Academy has a HUGE curriculum thanks to a slew of coders.

DAEMONCORE ACADEMY │ ├── PLATFORM CONTENT │ ├── 8 curriculum pathways │ ├── 127 lessons │ ├── 505 guided sections │ ├── 7,381 estimated minutes │ ├── 123+ hours of instruction │ ├── 12 Intel articles │ ├── 8 repeatable drill sets │ ├── 9 sealed range packs │ ├── 70 specialist range conditions │ ├── 3 capstones │ ├── 6 adaptive Mission OS domains │ ├── 6 role-based learning routes │ ├── Local progress record │ ├── Lesson scoring │ ├── Practical evidence artifacts │ ├── Testing Mode │ ├── Mastery Grid │ ├── XP and streak system │ ├── Achievement system │ └── Adaptive remediation │ ├── CURRICULUM PATHWAYS │ │ ├── CORE-01 │ │ └── FULL-SPECTRUM SECURITY ASSESSMENT │ │ │ │ │ ├── FOUNDATIONS │ │ │ ├── Scope and rules of engagement │ │ │ │ ├── Authorization is a technical input │ │ │ │ ├── Build a stop condition │ │ │ │ ├── Boundary review │ │ │ │ └── Keep the boundary visible │ │ │ ├── Reconnaissance as a hypothesis loop │ │ │ │ ├── Questions before commands │ │ │ │ ├── Choose the smallest test │ │ │ │ ├── Hypothesis review │ │ │ │ └── Update the model │ │ │ ├── Building an asset inventory │ │ │ │ ├── Normalize identifiers │ │ │ │ ├── Supplied versus observed │ │ │ │ ├── Identity review │ │ │ │ └── Attach provenance │ │ │ ├── Reading packet evidence │ │ │ │ ├── Follow the conversation │ │ │ │ ├── Understand absence │ │ │ │ ├── Packet review │ │ │ │ └── Capture with intent │ │ │ ├── Ports, protocols, and state │ │ │ │ ├── Ports are coordinates │ │ │ │ ├── Read state in context │ │ │ │ └── Expect nonstandard placement │ │ │ ├── Service fingerprinting │ │ │ │ ├── A banner is one witness │ │ │ │ ├── Triangulate identity │ │ │ │ ├── Fingerprint review │ │ │ │ └── Report confidence │ │ │ ├── Evidence that survives review │ │ │ │ ├── Observation before interpretation │ │ │ │ ├── Make reproduction cheap │ │ │ │ ├── Evidence review │ │ │ │ └── Minimize sensitive material │ │ │ └── From signal to finding │ │ │ ├── State the condition │ │ │ ├── Connect condition to consequence │ │ │ ├── Finding review │ │ │ └── Recommend the control │ │ │ │ │ ├── APPLICATION AND INFRASTRUCTURE │ │ │ ├── Windows and Linux attack surfaces │ │ │ │ ├── Model exposure by role │ │ │ │ ├── Configuration beats folklore │ │ │ │ └── Privilege is a graph │ │ │ ├── Web application surface mapping │ │ │ │ ├── Inventory behavior, not just routes │ │ │ │ ├── Follow transformations │ │ │ │ └── Use representative accounts │ │ │ ├── Authentication and session security │ │ │ ├── Authorization and tenant boundaries │ │ │ ├── Injection classes and safe validation │ │ │ ├── API and GraphQL assessment │ │ │ ├── Enterprise identity and directory paths │ │ │ ├── Cloud control-plane assessment │ │ │ ├── Containers and software supply chain │ │ │ └── Secrets and credential auditing │ │ │ │ │ └── VALIDATION AND REMEDIATION │ │ ├── Vulnerability validation and prioritization │ │ ├── Impact demonstration, cleanup, and retest │ │ ├── Linux privilege paths and proof │ │ │ ├── Effective identity │ │ │ ├── Controlling edges │ │ │ ├── Safe validation │ │ │ └── Path removal │ │ ├── Windows privilege paths and service control │ │ │ ├── Token authority │ │ │ ├── Service controls │ │ │ ├── Scheduled execution │ │ │ └── Descriptor proof │ │ ├── Active Directory control graphs │ │ ├── Kerberos tickets and trust decisions │ │ ├── Segmentation and pivot-path analysis │ │ ├── SSRF and internal trust boundaries │ │ ├── OAuth and OIDC flow validation │ │ └── CI/CD identity and provenance chains │ │ ├── WEB-201 │ │ └── WEB & API SECURITY ENGINEERING │ │ ├── HTTP transactions as evidence │ │ ├── Stateful attack-surface mapping │ │ ├── Cross-site scripting by output context │ │ ├── DOM dataflow and client-side sinks │ │ ├── CSRF and request authority │ │ ├── CORS origin decisions │ │ ├── CSP and browser containment │ │ ├── SQL injection and query structure │ │ ├── NoSQL operator injection │ │ ├── Command injection and process boundaries │ │ ├── Path traversal and canonicalization │ │ ├── File-upload trust pipelines │ │ ├── XXE and parser capabilities │ │ ├── Server-side template injection │ │ ├── Deserialization and type trust │ │ ├── SSRF and destination control │ │ ├── Authentication lifecycle failures │ │ ├── Session rotation and revocation │ │ ├── Object authorization and BOLA │ │ ├── JWT verification and key selection │ │ ├── OAuth redirect and state binding │ │ ├── GraphQL field authorization │ │ ├── Business-logic invariants │ │ ├── Race conditions and atomicity │ │ ├── HTTP request framing and desynchronization │ │ ├── Cache keys, poisoning, and deception │ │ └── API resource and abuse controls │ │ └── Every lesson: │ │ ├── Model the trust decision │ │ ├── Hold the boundary constant │ │ ├── Build discriminating evidence │ │ ├── Execute a sealed scenario │ │ ├── Submit an artifact │ │ └── Repair and retest │ │ └── ENTERPRISE FORGE │ │ │ ├── AD-301 — WINDOWS & ACTIVE DIRECTORY OPERATIONS │ │ ├── Directory topology and trust mapping │ │ ├── LDAP evidence and directory queries │ │ ├── Kerberos ticket flow and service identity │ │ ├── Directory ACL and control edges │ │ ├── Group Policy scope and precedence │ │ ├── Windows service identities │ │ ├── Kerberos delegation boundaries │ │ ├── Certificate Services trust │ │ ├── Local administrator pathways │ │ ├── Administrative tiering and protected identities │ │ ├── Directory attack telemetry │ │ └── AD path remediation and retest │ │ │ ├── CLD-301 — CLOUD SECURITY ENGINEERING │ │ ├── Cloud account and resource inventory │ │ ├── IAM policy evaluation │ │ ├── Role and workload trust │ │ ├── Object storage exposure │ │ ├── Cloud network control paths │ │ ├── Workload metadata boundaries │ │ ├── Key policy and cryptographic authority │ │ ├── Serverless event trust │ │ ├── Cloud audit evidence │ │ ├── Managed container identity │ │ ├── Organization guardrails │ │ └── Cloud remediation and retest │ │ │ ├── DET-301 — DETECTION ENGINEERING & INCIDENT ANALYSIS │ │ ├── Telemetry contracts and coverage │ │ ├── Detection hypotheses │ │ ├── Process-tree reasoning │ │ ├── Network and endpoint joins │ │ ├── Identity behavior analytics │ │ ├── Portable detection logic │ │ ├── Threshold and sequence tuning │ │ ├── Alert triage decisions │ │ ├── Incident timeline construction │ │ ├── Containment decision engineering │ │ ├── Detection validation │ │ └── Post-incident control closure │ │ │ ├── LNX-301 — LINUX PRIVILEGE & HOST SECURITY │ │ ├── Linux host evidence collection │ │ ├── Sudo policy semantics │ │ ├── Setuid and file capabilities │ │ ├── Systemd trust boundaries │ │ ├── Scheduled execution paths │ │ ├── Container-to-host boundaries │ │ ├── Kernel exposure triage │ │ ├── Linux secret locations │ │ ├── Linux service exposure │ │ ├── Mandatory access controls │ │ ├── Persistence review │ │ └── Linux remediation and retest │ │ │ ├── K8S-301 — CONTAINERS & KUBERNETES SECURITY │ │ ├── Image identity and trust │ │ ├── Pod security boundaries │ │ ├── Kubernetes RBAC evaluation │ │ ├── Service account lifecycle │ │ ├── Kubernetes network policy │ │ ├── Cluster secret handling │ │ ├── Admission control │ │ ├── Node and runtime trust │ │ ├── Cluster multitenancy │ │ ├── Container runtime detection │ │ ├── Deployment supply chain │ │ └── Cluster remediation and retest │ │ │ └── SUP-301 — SOFTWARE SUPPLY CHAIN DEFENSE │ ├── Source and review trust │ ├── Dependency graph analysis │ ├── SBOM quality and coverage │ ├── Build isolation and identity │ ├── Provenance verification │ ├── Artifact signing and verification │ ├── Registry control planes │ ├── Pipeline secret boundaries │ ├── Build cache integrity │ ├── Release integrity │ ├── Dependency vulnerability response │ └── Supply-chain remediation and retest │ ├── INTEL LIBRARY │ ├── Threat modeling a real trust boundary │ ├── DNS is evidence, not inventory │ ├── TLS identity and certificate chains │ ├── Linux process identity and privilege │ ├── Windows identity paths without guesswork │ ├── Effective cloud access in one trace │ ├── Container boundaries that matter │ ├── Software supply-chain proof │ ├── Detection engineering from first principles │ ├── Incident triage without destroying evidence │ ├── Credential lifecycle and secret exposure │ └── Reports that survive skeptical review │ ├── DRILL LIBRARY │ ├── Linux privilege paths │ ├── Windows authority graph │ ├── Session security │ ├── SSRF and egress boundaries │ ├── Container control review │ ├── Supply-chain verification │ ├── Detection telemetry │ └── Incident timeline │ ├── RANGE FABRIC │ ├── Artifact Zero │ ├── Broken Trust │ ├── Enterprise Forge │ ├── The Ghost Port │ ├── Identity Citadel │ ├── Night Shift │ ├── Policy Collision │ ├── Token Afterlife │ └── Web Forge │ │ └── Range mechanics │ ├── Docker-contained target │ ├── Operator container │ ├── Synthetic identities │ ├── Synthetic evidence │ ├── Network containment │ ├── No external target requirement │ ├── Evidence submission command │ ├── SHA-256 integrity records │ ├── Scenario contract │ └── Cleanup and retest │ ├── MISSION OS │ ├── Scope & Safety │ ├── Network Analysis │ ├── Web & API │ ├── Identity │ ├── Cloud & Supply Chain │ └── Evidence & Detection │ │ ├── Penetration Tester route │ ├── Web & API Specialist route │ ├── Identity Security route │ ├── Cloud Security route │ ├── Detection & Response route │ └── Security Engineer route │ │ └── Flagship missions │ ├── The Ghost Port │ ├── Broken Trust │ └── Night Shift │ ├── MASTERY GRID │ ├── Network evidence │ ├── Identity & trust │ ├── Application security │ ├── Host & platform │ ├── Cloud & delivery │ └── Evidence & reporting │ ├── PRINCIPAL CAPSTONES │ ├── CAP-01 — Night Glass │ │ └── Enterprise intrusion triage │ ├── CAP-02 — Broken Orbit │ │ └── Cloud control-plane compromise │ └── CAP-03 — Red Ledger │ └── Full-spectrum assessment closeout │ ├── LESSON ENGINE │ ├── Lesson briefing │ ├── Mental model │ ├── Objectives │ ├── Prerequisites │ ├── Evidence workshop │ ├── Practical case │ ├── Guided execution steps │ ├── Interactive decision review │ ├── Knowledge check │ ├── Artifact deliverable │ ├── References │ ├── Remediation recommendation │ └── Negative retest │ └── OPERATOR RECORD ├── Completed lessons ├── Lesson attempts ├── Practical scores ├── Drill attempts ├── Mission attempts ├── Enterprise lab attempts ├── Capstone attempts ├── XP ├── Level ├── Daily streak ├── Best streak ├── Achievements ├── Adaptive route ├── Domain mastery ├── Evidence history └── Remediation recommendations --- [COMING Q1 2027] --- ├── CORE-02 │ └── Advanced Security Operations │ ├── Advanced attack-path chaining │ ├── Purple-team validation │ ├── Complex identity and cloud compromise │ ├── Detection evasion and control testing │ ├── Incident command │ ├── Enterprise remediation │ └── Advanced capstone