Unit 1: Introduction
What the series is, how it runs, and what you will chase.
Course Overview
Follow Rider.exe through a real intrusion, from Tier 1 triage in Elastic to PsExec, identity, file and network telemetry, and the incident response decisions along the way. New episodes are added as the series continues.
Chasing Rider is a hands-on incident response series built around one intrusion. A suspicious Rider.exe shows up in C:\Windows\System32, and we follow it across systems, alert by alert and artifact by artifact, the way a SOC and IR team would work it for real.
The chase so far:
SOC Tier 1: triaging the first alert in Elastic and pivoting around an unknown executable before deciding to escalate.
SOC Tier 2: PsExec internals, telling local from remote execution, the built-in Administrator (RID 500), and file and network telemetry, up to how Rider.exe reached the domain controller.
Incident response: when to contain and when to scope first, and how to plan response tasks and investigation paths instead of reacting.
Along the way you work with Elastic Defend EDR, Windows internals and forensic artifacts, and build the habit of asking the right question before the next pivot.
The series is still running: new episodes are added to the course as they are released, so the chase keeps going.
Before you start
- Basic SOC or blue team experience
- Comfortable with Windows and its processes
- Familiar with SIEM or EDR alerts
Course Structure
Modules contain units, and each unit contains lessons, labs, and quizzes.
Unit 2: SOC Tier 1: Triage & First Pivots
The first alert on Rider.exe: triage in Elastic, and the questions a Tier 1 analyst asks before escalating.
Unit 3: SOC Tier 2: PsExec
How PsExec works under the hood, then pivoting around its execution to tell local from remote.
Unit 4: IR: Containment & Response Planning
Two incident response decisions: when to contain versus scope first, and how to plan response tasks and investigation paths.
Unit 5: SOC Tier 2: Following Rider's Trail
Identity, file and network telemetry, and how Rider.exe reached the domain controller.
- Lesson: 2.3 | SOC Tier 2 | Built-In Admin - RID 500 (Elastic Defend EDR) (Open)
- Lesson: 2.4 | SOC Tier 2 | Investigating File Telemetry (Elastic Defend EDR) (Open)
- Lesson: 2.5 | SOC Tier 2 | Investigating Network Telemetry & Cloudflare Context (Elastic Defend EDR) (Open)
- Lesson: 2.6 | SOC Tier 2 | How Rider.exe Reached the DC (Elastic Defend EDR) (Open)
Instructor
Ahmed Thabit
Founder, threat detection & response lead
Ahmed leads threat detection and response engagements at an Egyptian security service provider. He started programming nine years ago, worked as a web developer, then moved into bug hunting and penetration testing before joining the SOC and MDR side, building experience across DFIR, threat intelligence, detection engineering, Windows internals and threat hunting along the way.
He started the academy to build the courses he needed when he started: the short way through the years he spent finding things out the long way.