Name & Direct Link: Threat Hunting Labs

Cost: $0 – $281/year

Community: There is a Discord community

Description: A training platform built for threat hunters, SOC analysts, incident responders, and detection engineers who want to train the way they actually work. Every investigation runs against real intrusion telemetry from sanitized breach cases, inside a platform-native search console where you write real queries, form hypotheses, and validate findings with evidence. No synthetic noise or contrived puzzles. Just investigations that force you to think, adapt, and prove your conclusions.

Topics:

Threat Hunting Labs covers four core disciplines, all built on the same rich, real-world datasets:

• Threat Hunting: Proactively search through telemetry to find evil, form hypotheses, and follow the trail wherever it leads.
• Incident Response: Respond to a critical alert, triage the damage, and make time-pressured decisions with real consequences.
• Detection Engineering: Move beyond finding evil to codifying it. Write and tune detection rules against real attack patterns.
• Malware Analysis: Go hands-on with malware from the intrusion in a secure, dedicated REMnux environment tied to the case telemetry.

Name & Direct Link: Cloud Labs

Platform: Invictus Incident Response

Good for Beginners: There are easy labs available

Cost: Free – $58.56/month

Proof of Completion: The “All-In” subscription offers digital badges

Description: Hands-on practice with cloud incident response. Microsoft  365, Azure, Sentinal, AWS and more.

Name & Direct Link: Malops – Advanced Malware Analysis Training Platform

Cost: Free

Community: They have a Discord server

Description: Explore real-world malware scenarios, learn new techniques, and build confidence through practical experience.

Name & Direct Link: Xintra Labs

Platform: Xintra

Cost: $45/month to $459/year (There is a 7 day free trial)

Student Discount: There is a 15% student discount

Challenge Types: APT-Level Incidents

Community: There is a Discord server

Name & Direct Link: DFIR Labs

Platform: The DFIR Report

Cost: $14.99 – $29.99

Student Discount: Students get 30% off. Instructions can be found HERE.

Proof of Completion: Certificate and Badge upon completing the lab and quiz.

Description: Analyze logs related to published DFIR Reports.

Name & Direct Link: CryptoHack

Community: They have a Discord Server

Topics: Courses and Challenges Related to Cryptography

Challenges Include: ASCII, RSA, XOR, Symmetric Ciphers, Diffie-Hellman, Elliptic Curves, Hash Functions, JSON Web Tokens

Courses Include: Introduction to Cryptohack, Modular Arithmetic, Symmetric Cryptography, Public-Key Cryptography, Elliptic Curves

Name & Direct Link: OSINT Quiz

Platform: GitHub

Topics: OSINT and Geolocation Quiz Tasks

Name & Direct Link: List of DFIR CTFs and Test Images

Platform: DFIR Training

Name & Direct Link: ACE Responder

Cost:

Analyst – $17.49/month after a 14-day free trial (realistic pre-recorded attacks, full-featured defensive platforms, browser-based challenges and modules, extended attack videos)

Defender – $44.49/month (includes Analyst-level content + instant fully interactive labs, hands-on prevention and detection, offensive techniques, security engineering exercises, highly realistic and dynamic scenarios)

Some of the Topics Included Are: Impacket Basics, Intro to Auditd, Intro to Wazuh, Defending Active Directory Trusts, Active Directory DACL Abuse, Intro to Threat Hunting, Intro to Hack Back, Intro to Detection Engineering, UAC Bypasses, Lateral Movement, Phishing Basics, Exchange Logons, Windows Logons, SIEM.

Community: There is an ACE Responder Discord Server

Name & Affiliate Link*: Sherlocks DFIR Labs

Platform: Hack The Box

Cost: All Sherlocks are free for the initial release, then some will be part of the premium labs included in VIP and VIP+ subscriptions ($14 – $20/month or $135 – $203/year)

Proof of Completion: Shareable Link

Community: There is a Hack The Box Discord Server

*DFIR Diva is an affiliate of Hack the Box and receives a small percentage of sales made through affiliate links that go toward keeping the site running.