Skip to main content
TRACK 1 // TECHNICAL

0xSAC // LIVEFIRE & CTF

A contested, instrumented cyber range where five defending pods hold the line against a dedicated adversary cell. You will baseline, harden, hunt, and evict — while keeping mission services online and solving CTF challenges along the way.

SOC Analysts Incident Responders Network Defenders Red / Blue Operators

0x0100 // Range environment

Inside the range

Each pod receives an identical, isolated enterprise slice hosted in vendor-provided commercial cloud. Pods share a scenario but never share infrastructure — your mistakes stay in your enclave.

The range has zero connectivity to production, government, or military networks. Read the separation statement.

  • edge/Firewall, VPN concentrator, DMZ web services
  • identity/Directory services, SSO, privileged accounts
  • workloads/Windows & Linux servers, user endpoints
  • mission/Scored services your sector depends on
  • telemetry/SIEM, full packet capture, EDR feeds

0x0200 // Pod architecture

Five defending pods

Pods are organized by sector so teams defend an environment that looks like home — and so the adversary can tailor tradecraft to each mission set.

  • POD 0x01

    Joint Military / Reserve

    ARNG / ANG / USMCR

    Guard and reserve cyber personnel defending a simulated unit network in an educational setting.

  • POD 0x02

    State / SLED

    California State Agencies

    State security operations staff protecting citizen-facing services and sensitive records.

  • POD 0x03

    Municipal / Local Gov

    City & County IT / Public Safety

    Local IT and public-safety technologists keeping dispatch, permitting, and payment systems online.

  • POD 0x04

    Critical Infrastructure / Utility

    SCADA & Regional Water / Power

    OT and utility defenders protecting a simulated control-system environment and its IT bridge.

  • POD 0x05

    Commercial Tech & Detection Specialists

    Private Sector / Detection Engineering

    Enterprise defenders and detection engineers hunting across a commercial SaaS-style environment.

0x0300 // Threat profile teaser

APT-916 "Dark Delta"

TLP:CLEAR // FICTIONAL ADVERSARY

A financially and politically motivated intrusion set named for the Sacramento–San Joaquin River Delta and the 916 area code. Dark Delta favors living-off-the-land tradecraft, patient credential harvesting, and timed disruption of public-facing services to maximize leverage over leadership.

Initial Access
Phishing, exposed VPN (T1566, T1133)
Persistence
Valid accounts, scheduled tasks (T1078, T1053)
Lateral Movement
Remote services (T1021)
Objective
Exfiltration & impact (T1041, T1486)

Full intelligence package is released to registered pods at the Opening Briefing.

0x0400 // Participant brief

Rules, readiness & scoring

Rules of Engagement

  • Operate only inside your assigned pod address space.
  • No attacks against range infrastructure, scoring engine, or other pods.
  • Do not shut down or firewall-off scored services to "win" — availability is scored.
  • White Cell rulings are final; request adjudication through your pod lead.
  • No real-world data, malware, or credentials may enter the range.

Prerequisites

  • Bring your own laptop (8 GB+ RAM, admin rights, charger).
  • Working SSH client and the ability to install a VPN client.
  • Outbound VPN not blocked by employer endpoint policy — verify beforehand.
  • Comfort with the Linux/Windows CLI, log analysis, and packet basics.

Scoring Metrics

SLA Uptime
Continuous health checks on each pod's mission services.
Containment Latency
Time from adversary action to verified detection and eviction.
CTF Flags & Reporting
Challenge flags plus quality of incident reports to the White Cell.

CPE Credit Validation

Participants who complete all three phases are eligible for up to 8 CPE credits. Attendance is verified by range-credential activity and sign-in at the Opening Briefing and Hotwash. Certificates of participation are issued at the close of Phase III for self-reporting to your certifying body.

Register for Track 1 Leading, not typing? See Track 2 →