Along with the MITRE ATT&CK mapping,
it is always helpful to visualize where this activity
is happening in the environment.
It may be the key that makes it click for you on how to leverage
the capability, or it may be how you understand whether this
technique or tool applies to you at all.
But either way,
each course will provide you with a spatial understanding of how this
attack plays out in a notional environment as well.
Now it's a bit abstracted, but that's for good reason.
By using the same graphical concept,
I can cover a tool like Recon‑ng that really is mainly focusing on
things that are completely outside of the environment,
like this, or something like BloodHound that's operating from a compromised
workstation with Active Directory access inside the environment.
And this provides you with a quick understanding of the
basic functions of these tools and where they land in
relation to organizations' assets.