Upskilling Training

Threat Hunting

Cyber threat hunting is an active cyber defence activity. Threat hunting uses known adversary behaviours to proactively examine the network and endpoints in order to identify new data breaches.

This in-depth threat hunting course provides SOC analyst, Incident Response Team Members and Threat Hunting Teams with advanced skills to hunt down, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hacktivists. The course uses a hands-on lab to lead you to challenges and solutions via extensive use of the best of breed investigative tools.

English

Duration 4 Days

Who Should Attend?

All employees who want to know how to detect, investigate, fix and recover systems that have been compromised at the endpoints of the organization. Especially for:

  • Information Security Professionals
  • SOC Analysts
  • Incident Response Team Members
  • Red Team Members
  • Penetration Testers
  • Exploit Developer

Course Syllabus

Introduction to Threat Hunting

  • What is threat hunting?

Incident Response

  • Incident Response & Hunting

Risk Assessment

  • What are risk assessments?
    • Risk Assessments & Hunting

What is threat intelligence?

  • Using threat intelligence to Hunt

What is digital forensics?

  • Using digital forensics to hunt

Threat Hunting/Intelligence Simulation

Threat Hunting Terminology

  • APT (Advanced Persistent Threat)
  • TTP (Tools, Tactics, and Procedures)
  • Pyramid of Pain
  • The Cyber Kill Chain Model
  • The Diamond Model

ATT&CK - MITRE's Adversarial Tactics, Techniques, and Common Knowledge

Threat Intelligence

  • MISP - Open Source Threat Intelligence Platform

Open Standards for Threat Information Sharing

  • CRITs (Collaborative Research into Threats)

    • IOCs (Indicators of Compromise)
    • IOC Editor
    • OpenIOC
    • STIX (Structured Threat Information Expression)
    • CyBOX (Cyber Observable Expression)
    • TAXII (Trusted Automated Exchange of Indicator)

  • Threat Reports & Research

Threat Sharing & Exchanges

  • Government-sponsored threat sharing
    • DHS/CISCP (Department of Homeland Security / Cyber Information Sharing and Collaboration Program)
    • US-CERT (US Computer Emergency Readiness Team)

Vendors

  • Alien Vault OTX (Open Threat Exchange)
    • Threat Connect
    • IBM X-Force Exchange
    • Anomali ThreatStream
    • Palo Alto Networks AutoFocus
    • RSA NetWitness Suite

Introduction to Endpoint Hunting

  • Endpoint Analysis
  • Introduction to Endpoint Hunting
  • Introduction
  • Windows Processes
  • Endpoint Baselines

Identification of Compromised Systems

Hunting with PowerShell

  • Kansa
  • Invoke-IR
  • Microsoft ATP & ATA

Malware Overview

  • Introduction
  • Malware Classifications
  • Malware Delivery
  • Malware Evasion Techniques
  • Malware Persistence

Hunting Malware

  • Introduction
  • Detection Tools
  • Memory Analysis

Malware Persistence Identification

  • AutoStart Locations, RunKeys
    • Service Creation
    • Service Failure Recovery
    • Scheduled Tasks

Event IDs, Logging, and SIEMs

  • Event IDs, Logging and SIEMs
  • Windows Event Logs
  • PowerShell Logging
  • Windows Event IDs
  • Suspicious Account Usage & Creation
  • Passwords
  • Hashes (PTH)
  • Forged Kerberos Tickets
  • RDP
  • PsExec & WMIX
  • Scheduled Tasks
  • Service Creation
  • Admin Shares
  • Lateral Movement
  • Windows Event Forwarding
  • Log Rotation & Log Clearing
  • Tools
  • Sysmon

Introduction to Network Hunting

  • Network Analysis
  • Introduction
  • TCP/IP & Networking Primer
  • Tools

Suspicious Traffic Hunting

  • Suspicious Traffic Hunting
  • ARP
  • ICMP
  • TCP
  • DHCP
  • DNS
  • HTTP/HTTPS
  • Tools

SIEMs (ELK & Splunk)

The Hunting ELK

Pre-requisites

This is an advanced course. A solid knowledge of attack techniques, networking, malware investigations, including network and forensic investigations are also prerequisites for attending this course.

  • Fundamental understanding of computer networks, OSI (TCP/IP), DNS, HTTPS, SMTP, etc. knowledge
  • Understanding of fundamental information security concepts
  • Knowledge of networking devices and security solutions: firewalls, antivirus, and endpoint security applications, Switches, Routers
  • Basic knowledge of Linux and Windows command line

Expert

Select a subject...Security Tests & AuditsCybersecurity as a ServiceCareer ProgramUpskilling Training