CYBRARY Program
Adversary craft & systems
Host-level ground truth: patch state, exploitation preconditions and the machine behavior every detection above it depends on.
Who it is for: Vulnerability analysts, red-adjacent engineers and platform defenders.
The path through it
Patch state is the precondition for most of what a SOC ever sees. Establish what a machine really runs, decide whether the fix is genuinely applied, and remediate without masking the finding or dropping the service.
- 1 · Ground truth on one host
What is installed, what is actually running, and why the inventory disagrees with both.
- pl-101Baseline drift on the internal DNS resolver25 min
- pl-102The upgrade that quietly does nothing25 min
- 2 · When the patch report lies
Dead sources and backported fixes: two different reasons a green report means nothing.
- pl-103The patch job that never had anything to install25 min
- pl-105Oldstable: the fix that lives somewhere else25 min
- 3 · Change without an outage
Remediation is judged on the service afterwards, and on whether you kept the guardrails on.
- pl-104The patch that took the resolver down25 min
- pl-106Patch the RHEL resolver without disabling SELinux25 min
- 4 · Servicing state and the software supply chain
Installed is not loaded, and a package that looks right is where supply-chain trouble hides.
- pl-201Patched on paper, unpatched in memory25 min
- pl-202Two agents, one product family25 min
- pl-203The package that looked right25 min
NICE capabilities this program evidences
- Vulnerability and patch assurancefirst proven in pl-101Establish what a host actually runs, decide whether the fix is really applied, and remediate without masking the finding or taking the service down.
- Control assurancefirst proven in pl-102Prove a control collects, matches and notifies — and find the stage where it does not.
- Evidence handlingfirst proven in pl-105Preserve artifacts and keep an auditable chain from observation to conclusion.
Roles this program trains toward
- Vulnerability & patch assurance analyst
The seat that decides what a machine actually runs, whether the fix is genuinely applied, and how to close the finding without masking it or taking the service down.
ATT&CK techniques this host state enables
- T1068Exploitation for Privilege EscalationPrivilege Escalation
- T1078Valid AccountsDefense Evasion
- T1082System Information DiscoveryDiscovery
- T1112Modify RegistryDefense Evasion
- T1190Exploit Public-Facing ApplicationInitial Access
- T1195.002Supply Chain Compromise: Software Supply ChainInitial Access
- T1203Exploitation for Client ExecutionExecution
- T1210Exploitation of Remote ServicesLateral Movement
- T1211Exploitation for Defense EvasionDefense Evasion
- T1518Software DiscoveryDiscovery
- T1543Create or Modify System ProcessPersistence
- T1547Boot or Logon Autostart ExecutionPersistence
Other programs
- SOC operations — The detection and response core: query telemetry, triage a queue, hunt a hypothesis, automate the response and prove the control fired.
- Ransomware resilience — Everything after impact: trustworthy recovery points, isolated proof, forest recovery, staged reconnection and an after-action record that survives review.
- Governance & audit — Controls, evidence and the paperwork an auditor will actually accept — assessed the way a real assessment runs, on artifacts rather than assertions.
- AI security — Securing the agents now sitting inside the SOC: prompt injection, poisoned tool catalogs, approval ceilings and the oversight boundary around autonomy.