SomNOG9 Workshops: Cybersecurity
from
Saturday, 19 September 2026 (08:00)
to
Monday, 21 September 2026 (18:00)
Monday, 14 September 2026
Tuesday, 15 September 2026
Wednesday, 16 September 2026
Thursday, 17 September 2026
Friday, 18 September 2026
Saturday, 19 September 2026
09:30
Opening, Track Orientation, Ethics, Lab Rules & Pre-Assessment
-
Eng Bille
Opening, Track Orientation, Ethics, Lab Rules & Pre-Assessment
Eng Bille
09:30 - 10:00
10:00
Cybersecurity Foundations: CIA, Risk, Controls, IAM & Least Privilege
-
Eng Liban
Cybersecurity Foundations: CIA, Risk, Controls, IAM & Least Privilege
Eng Liban
10:00 - 10:30
10:30
Networking for Cybersecurity: TCP/IP, DNS, HTTP/S, SSH, ICMP, Firewalls, IPv4/IPv6
-
Eng Abdulkadir
Networking for Cybersecurity: TCP/IP, DNS, HTTP/S, SSH, ICMP, Firewalls, IPv4/IPv6
Eng Abdulkadir
10:30 - 11:00
11:00
Morning Break
Morning Break
11:00 - 11:30
11:30
Lab 1: Network & Service Discovery
-
Eng Abdulkadir
Lab 1: Network & Service Discovery
Eng Abdulkadir
11:30 - 12:00
12:00
Linux Fundamentals for cybersecurity
-
Eng Ismail
Linux Fundamentals for cybersecurity
Eng Ismail
12:00 - 12:30
12:30
Lunch
Lunch
12:30 - 13:30
13:30
Mitra Attack, Kill chain, unified Kill chain, diamond models, pyramid of pain,
-
Eng Meymun
Mitra Attack, Kill chain, unified Kill chain, diamond models, pyramid of pain,
Eng Meymun
13:30 - 14:00
14:00
Threats, Vulnerabilities, Attack Surface & Introductory Adversary Workflow
-
Eng Meymun
Threats, Vulnerabilities, Attack Surface & Introductory Adversary Workflow
Eng Meymun
14:00 - 14:40
14:45
Cybersecurity Lab Environment preparations
Cybersecurity Lab Environment preparations
14:45 - 15:00
15:00
Why a SOC matters · today's threat landscape (who attacks, how they get in)
-
Eng Liban
Why a SOC matters · today's threat landscape (who attacks, how they get in)
Eng Liban
15:00 - 15:30
15:30
Afternoon Break
Afternoon Break
15:30 - 16:00
16:00
SOC operations, tiers, the incident lifecycle, the analyst's skills, Core SOC technologies, SIEM, EDR/XDR, SOAR; log sources & telemetry.
-
Eng Bashir
SOC operations, tiers, the incident lifecycle, the analyst's skills, Core SOC technologies, SIEM, EDR/XDR, SOAR; log sources & telemetry.
Eng Bashir
16:00 - 16:50
16:50
Reading an alert · True vs False Positive · KQL basics · the escalation ladder
-
Eng Bashir
Reading an alert · True vs False Positive · KQL basics · the escalation ladder
Eng Bashir
16:50 - 17:00
Sunday, 20 September 2026
08:00
Day 1 Review & Short Quiz
Day 1 Review & Short Quiz
08:00 - 08:30
08:30
Footprinting and Reconnaissance
-
ENG Liiban
Footprinting and Reconnaissance
ENG Liiban
08:30 - 09:00
09:00
Lab 2: Footprinting and Reconnaissance
-
All Team
Lab 2: Footprinting and Reconnaissance
All Team
09:00 - 10:00
10:00
Morning Break
Morning Break
10:00 - 10:30
10:30
Scanning Networks and Enumeration
-
Eng Liiban
Scanning Networks and Enumeration
Eng Liiban
10:30 - 10:50
10:50
Lab 3: Scanning Networks and Enumeration
-
All Team
Lab 3: Scanning Networks and Enumeration
All Team
10:50 - 11:30
11:30
Vulnerabilities, CVE, CVSS & Vulnerability Management
-
Liban
Vulnerabilities, CVE, CVSS & Vulnerability Management
Liban
11:30 - 11:50
11:50
Lab 4: exploit some local machine with Metasploit framework
-
Eng Abdulkadir
Lab 4: exploit some local machine with Metasploit framework
Eng Abdulkadir
11:50 - 12:30
12:30
Lunch
Lunch
12:30 - 13:30
13:30
Web Application Security & Selected OWASP Concepts
-
Eng Ismail
Web Application Security & Selected OWASP Concepts
Eng Ismail
13:30 - 14:00
14:00
Lab 5: Web Application Security
-
Eng Ismail
Lab 5: Web Application Security
Eng Ismail
14:00 - 15:30
15:00
Navigating the SIEM · running KQL · triage workflow · correlating events · separating signal from noise.
-
Eng Bashir
Navigating the SIEM · running KQL · triage workflow · correlating events · separating signal from noise.
Eng Bashir
15:00 - 15:30
15:30
Afternoon Break
Afternoon Break
15:30 - 16:00
16:00
Lab 6: SMB/RDP Brute force, from an internal and external attackers
-
Eng Bashir
Lab 6: SMB/RDP Brute force, from an internal and external attackers
Eng Bashir
16:00 - 16:50
16:50
Lab 7 : Network reconnaissance / port scan, Malicious PowerShell, LOLBin download and Multi-step attack mapped to ATT&CK (recon → brute → credential access)
Lab 7 : Network reconnaissance / port scan, Malicious PowerShell, LOLBin download and Multi-step attack mapped to ATT&CK (recon → brute → credential access)
16:50 - 17:00
Monday, 21 September 2026
08:00
Day 2 Review
Day 2 Review
08:00 - 08:20
08:20
Web application penetration testing concepts
-
Eng Ismail
Web application penetration testing concepts
Eng Ismail
08:20 - 09:00
09:10
Lab 8: preform real time web application penetration testing
-
All Team
Lab 8: preform real time web application penetration testing
All Team
09:10 - 10:00
10:00
Morning Break
Morning Break
10:00 - 10:30
10:30
CTF competitions. “Should be prepared”`
-
Ismail , Liban
CTF competitions. “Should be prepared”`
Ismail , Liban
10:30 - 12:30
12:30
Lunch
Lunch
12:30 - 13:30
13:30
Risk and risk mitigation strategies
-
Eng Liban
Risk and risk mitigation strategies
Eng Liban
13:30 - 14:30
14:30
endpoint attack analysis · defense-evasion & ransomware behavior · cloud control-plane attacks · threat-intel enrichment · containment & reporting
-
Eng Bashir
endpoint attack analysis · defense-evasion & ransomware behavior · cloud control-plane attacks · threat-intel enrichment · containment & reporting
Eng Bashir
14:30 - 15:30
15:30
Afternoon Break
Afternoon Break
15:30 - 16:00
16:00
Lab 10: Phishing link click (look-alike DNS / mshta URL), Malicious PowerShell / LOLBin download, Host & domain discovery, Defender / firewall disabled (defense evasion), Shadow-copy deletion (ransomware precursor) and Ransomware , ransom note dropped / files encrypted
-
Eng Bashir
Lab 10: Phishing link click (look-alike DNS / mshta URL), Malicious PowerShell / LOLBin download, Host & domain discovery, Defender / firewall disabled (defense evasion), Shadow-copy deletion (ransomware precursor) and Ransomware , ransom note dropped / files encrypted
Eng Bashir
16:00 - 16:45
16:45
Post-Assessment, Career & Certification Roadmap, Closing
Post-Assessment, Career & Certification Roadmap, Closing
16:45 - 17:00