Inicio / Catálogo de cursos / Respuesta a incidentes y Threat Hunting Avanzado 2...


Obtener este curso (€1,000.00)

Respuesta a incidentes y Threat Hunting Avanzado 2026


Descripción


No es necesario presentarse a la practica final.

Contenido
  • BIENVENIDO AL CURSO
  • MÓDULO 1 - Detección y respuesta proactivas
  • Detección y Respuesta
  • MÓDULO 2 - Ampliación de la respuesta y el análisis
  • Ampliación de la respuesta y el análisis
  • MÓDULO 3 - Ataques modernos contra Windows y Linux
  • Ataques Modernos contra Windows y Linux
  • MÓDULO 4 - Análisis de macOS y contenedores Docker
  • Análisis de macOS y Contenedores Docker
  • MÓDULO 5 - Ataques y respuesta en la nube
  • Ataques y respuesta en la nube
  • VIDEOS en Inglés
  • 1.1 Videos "IR in the Enterprise"
  • 1- Proactive Detection and Response
  • 2- Welcome to Enterprise-Class Incident Response & Threat Hunting
  • 3- Lab 0
  • 4- Curriculum (1)
  • 5- FOR608 Course Agenda
  • 6- FOR608.1 Agenda
  • 7- Incident Response in the Enterprise
  • 8- Enterprise Incident Response Tactics
  • 9- Motivation
  • 10- It's never too late to start doing it right! 
  • 11- Large Scale IR 
  • 12- It's Just Bigger, Isn't It
  • 13- Incident Response and Project Management 
  • 14- Incident Response Cycle 
  • 15- Containment vs. Remediation
  • 16- Active Defense for Slowing Down the Attacker 
  • 17- Active Defense for Detecting the Attack 
  • 18- Cyber Deception
  • 19- Honeypots 
  • 20- Open-Source Honeypot Projects
  • 21- Honeytokens-Canary Tokens 
  • 22- Honeytokens-Canary Tokens Made Easy 
  • 23- Lab 1.1 
  • 24- Enterprise Incident Response Constraints
  • 25- Phases in Large-Scale IR 
  • 26- Other Influence Factors 
  • 27- Access to the Actual Infrastructure 
  • 28- Outsourcing 
  • 29- PaaS 
  • 30-SaaS 
  • 31- Virtualization
  • 32- Stark Research Labs Incident 
  • 33- The Future of Biotech 
  • 34- Additional Information
  • 35- SRL Labs Base Security Information
  • 36- SRL Network 
  • 37- Spader Tech
  • 38- How It All Begins 
  • 39- Lab 1.2 
  • 1.2 Videos "Managing Large Scale Response"
  • 1- FOR608.1 Agenda 
  • 2- Enterprise IR Requirements 
  • 3- Key Principles for Successful IR 
  • 4- Types of Visibility 
  • 5- Establish Vertical Visibility 
  • 6- Establish Horizontal Visibility 
  • 7- Establish a Visibility Stack 
  • 8- Endpoint Detection and Response 
  • 9- Log Centralization (SIEM) 
  • 10- Network-Based Detection Methodologies 
  • 11- Forensic Agents 
  • 12- Verify Visibility with Threat Hunting 
  • 13- Efficiency 
  • 14- Resource Pools 
  • 15- Technical Skills 
  • 16- Documentation 
  • 17- Soft Skills 
  • 18- Team Setup Blueprint 
  • 19- Usual Team Structure 
  • 20- Roles and Duties (1) 
  • 21- Roles and Duties (2) 
  • 22- External Entities
  • 23- Incident Resource Management 
  • 24- Resources 
  • 25- Types of Resources 
  • 26- Resource Management 
  • 27- Predefined Tasks 
  • 28- Main Tasking Directive 
  • 29- Assign Tasks
  • 30- CRM in IR 
  • 31- History of Crew Resource Management (CRM) 
  • 32- Crew Resource Management 
  • 33- 7 Skills of CRM 
  • 34- Selected Key Elements for IR
  • 35- Documentation and Reporting 
  • 36- Documentation Is Critical 
  • 37- Important Auxiliary Features for a Documentation Solution 
  • 38- Things to Keep Track of in the Documentation... 
  • 39- Track the Master Timeline 
  • 40- Track Artifacts 
  • 41- Track Systems 
  • 42- Track Tasks
  • 43- Track People 
  • 44- Track Exfiltration
  • 45- Track Intelligence 
  • 46- Track Victim Details 
  • 47-Tracking with the "Spreadsheet of Doom" (SOD)
  • 48- Various Software Options for IR Case Tracking 
  • 49- Excel 
  • 50- Aurora IR 
  • 51 - Aurora IR- Visualization (1 ) 
  • 52- Aurora IR- Visualization (2) 
  • 53- Aurora IR- Visualization (3) 
  • 54- DFIR-IRIS 
  • 55- Google Sheets 
  • 56- FOR608 Capstone Design Goals
  • 57- FOR608 Capstone Options (In-Person Classes) 
  • 58- FOR608 Capstone Game Plan (In-Person Classes) 
  • 59- Lab 1.3 
  • 1.3 Videos "Collaborative Analysis with Timesketch"
  • 1- FOR608.1 Agenda 
  • 2- Evolution of Timeline Analysis 
  • 3- Timeline Creation with Plaso and log2timeline.py
  • 4- Next-Level Timeline Analysis with Timesketch
  • 5- Timesketch Core Concepts 
  • 6- Collaborating with Timesketch 
  • 7- Powerful Searching with Elasticsearch-OpenSearch
  • 8- Timesketch Visualizations
  • 9- Tagging Events of Interest 
  • 10- Saved Searches 
  • 11- Using Analyzers for Detection & Enrichment 
  • 12- Creating New Analyzers 
  • 13- Threat Intel and Timesketch
  • 14- HashR and Context Links for Filtering and Enrichment 
  • 15- Documenting and Automating Analysis with Notebook 
  • 16- Elasticsearch-OpenSearch Backend Allows Flexibility 
  • 17- Getting Started- Adding Timelines 
  • 18- timesketchjmporter CLl Tool 
  • 19- Lab 1.4 
  • 1.4 Videos "Threat Hunting and Intel Driven IR"
  • 1- FOR608.1 Agenda 
  • 2- Threat Hunting & Intelligence Driven IR 
  • 3- What Is Threat Hunting
  • 4- Threat Hunting 
  • 5- Forms of Threat Hunting 
  • 6- Threat Hunting in the Enterprise
  • 7- Measuring Success 
  • 8- Value of Threat Intelligence 
  • 9- Threat Intel Covers All Levels 
  • 10- Strategy- Typical Questions to Answer
  • 11- Tactical- Typical Questions to Answer 
  • 12- Operational- Typical Questions to Answer
  • 13- Developing Knowledge
  • 14- Sources of Intelligence 
  • 15- The Intelligence Flow 
  • 16- Threat Reports
  • 17- Peer Data 
  • 18- Research 
  • 19- Threat Intel Feeds and OSINT
  • 20- How to Develop Knowledge 
  • 21 - Connecting the Dots 
  • 22- Normalize and Categorize 
  • 23- MITRE ATT&CK® Framework 
  • 24- MISP 
  • 25- OpenCTl 
  • 26- Important Entities in OpenCTl 
  • 27- From Intel to Hypothesis (1)
  • 28- From Intel to Hypothesis (2)
  • 29- Lab 1.5 
  • 30- Curriculum (2) 
  • 31- Contacts and Resources 
  • 2.1 Videos "EDR and EDR Evasion"
  • 1- Scaling Response and Analysis 
  • 2- Curriculum (1) 
  • 3- FOR608.2 Agenda 
  • 4- Intrusion Methodology Roadmap (1)
  • 5- EDR OVERVIEW 
  • 6- EDR Evolution
  • 7- EDR Today- Core Detection Functionality 
  • 8- EDR Today- Common Response Capabilities
  • 9- MITRE Engenuity EDR Evaluations 
  • 10- System Monitor (Sysmon) Logging 
  • 11- Sysmon Configuration Files 
  • 12- EVADING EDR VISIBILITY 
  • 13- Parent Process and Command Line Spoofing 
  • 14- EDR API Hooking 
  • 15- Circumventing EDR Hooking
  • 16- Avoiding Detection through Obfuscation (1 ) 
  • 17- Avoiding Detection through Obfuscation (2) 
  • 18- Minimize Process Execution (1) 
  • 19- Minimize Process Execution (2) 
  • 20- Avoiding EDR Altogether
  • 21- EDR in the Crosshairs 22- Lab 2.1
  • 22- Lab 2.1 
  • 2.2 Videos "Enterprise Visibility with Velociraptor"
  • 1- FOR608.2 Agenda
  • 2- Enterprise IR Tooling- Filling the Gaps for Endpoint Response 
  • 3- Introducing Velociraptor 
  • 4- Velociraptor Features 
  • 5- Usage Scenarios 
  • 6- Velociraptor Architecture 
  • 7- Overview of a Basic Deployment Process 
  • 8-The Simplest Option Run Clientserver on Localhost via "gui" 
  • 9- Velociraptor Navigation 
  • 10- Velociraptor Web Frontend- Artifact Parsing & Analysis
  • 11 - Velociraptor Web Frontend- Retrieving Files 
  • 12- Velociraptor Query Language (VQL) 
  • 13 What Are Velociraptor Artifacts
  • 14- Velociraptor Web Frontend- Artifact Repository 
  • 15- VQL Query Types- Collection and Event Queries 
  • 16- Adding Client Monitoring Artifacts
  • 17- Example Client Monitoring Artifact- DNS Queries 
  • 18- Example Client Monitoring Artifact- Process Creation 
  • 19- Data Review Options for Velociraptor Collections
  • 20- Velociraptor Notebooks 
  • 21- VQL Data Transformations in Notebooks 
  • 22- Velociraptor Resources
  • 23- Lab2.2A 
  • 24- Lab2.2B 
  • 25- Lab2.2C 
  • 26- Lab 2.2D 
  • 2.3 Videos "Scaling Analysis with the Elastic Stack"
  • 1- FOR608.2 Agenda
  • 2- Tactical Use of the Elastic Stack for DFIR 
  • 3- Tooling to Support Scale
  • 4- Why Elastic Specifically?
  • 5- What About OpenSearch?
  • 6- Elastic Stack Overview (1) 
  • 7- Components of the Elastic Stack (aka ELK)
  • 8- Elasticsearch Architecture Terminology 
  • 9- Kibana Usage 
  • 10- Query Syntax Options from Kibana's User Interface 
  • 11 - Leveraging Elasticsearch SQL for Search and Aggregation 
  • 12- Elastic Stack Overview (2) 
  • 13- Tactical ELK Scenarios and Solutions 
  • 14- DFIR Scenarios for Tactical Elastic Stack Usage 
  • 15- Scenario 1 - Recovered Event Logs from Backup 
  • 16- Scenario 1 Solution- Forwarding Event Logs via Winlogbeat 
  • 17- Scenario 2- Other OS or Application Logs
  • 18- Scenario 2 Solution- Use Prebuilt Parsers 
  • 19- Scenario 3- Large Collection of Custom CSV Data
  • 20- Scenario 3 Solution- Filebeat - Logstash - Elasticsearch 
  • 21 - Scenario 4- Forensic Artifact Parsing and Analysis
  • 22- Scenario 4 Solution- Log2timeline Data to Elasticsearch
  • 23- Scenario 5- Enterprise Threat Hunting 8- Incident Response
  • 24- Scenario 5 Solution- Velociraptor to Elasticsearch 
  • 25- Scenario 5 Solution: Kansa "Fire & Forget"
  • 26- Scenario 5 Solution- Elasticsearch Osquery Management 
  • 27 - Scenario 5 Solution: Elasticsearch "Limitless XDR"
  • 28- Elastic Stack Overview (3)
  • 29- Where to Go Next
  • 30- Lab 2.3A 
  • 31- Lab2.3B 
  • 2.4 Videos "Rapid Response Triage and Data Processing"
  • 1- FOR608.2 Agenda
  • 2- Rapid Response Triage
  • 3- Intrusion Methodology Roadmap (2) 
  • 4- The Deep-Dive Analysis Challenge (at Scale) 
  • 5- Triage Acquisition Tools 
  • 6- Triage Acquisition Tooling 
  • 7- KAPE Overview
  • 8- Target Collection 
  • 9- KAPE Target File Examples
  • 10- Velociraptor Offline Collector
  • 11 - Velociraptor Supports KAPE Target Files 
  • 12- Collecting Bulk Acquisition Data with CyLR 
  • 13- Initiating Triage & Collecting Data 
  • 14- Remote Collector Launch 
  • 15- Transfer Options to Receive Triage Collection
  • 16- Processing Triage Data 
  • 17- Where Is the Best Location to Process Triage Evidence
  • 18- Client-Side Processing Tools
  • 19- The Goal of Server-Side Processing 
  • 20- Scripting FTW! 
  • 21- Velociraptor Triage to Timesketch Analysis 
  • 22- Using SOAR and IT Automation Frameworks 
  • 23- Finding the Right Automation Solution(s)
  • 24- SOAR for Forensic Workloads- dfTimewolf 
  • 25- SOAR for Forensic Workloads- Turbinia 
  • 26- Building Automation Workflows with Node-RED 
  • 27- Next-Level Triage Processing with Node-RED
  • 28- Lab 2.4 
  • 29- Lab 2.5 
  • 30- Curriculum (2) 
  • 31- Contacts and Resources 
  • 3.1 Videos "Modern Attack Techniques"
  • 1- Modem Attacks against Windows and Linux DFIR 
  • 2- Curriculum Slide (1) 
  • 3- FOR608.3 Agenda
  • 4- Modern Attack Techniques
  • 5- Responding to Modern Attacks- Topics (1 ) 
  • 6- Modern Attacks- The Evolution 
  • 7- Compromise -Types
  • 8- -Fileless- Malware 
  • 9- -Fileless- Malware- Memory Only Execution
  • 10- -Fileless- Malware- Script Link in Registry 
  • 11- -Fileless- Malware- Code in Registry 
  • 12- -Fileless- Malware- WMI Use 
  • 13- Living Off the Land 
  • 14- Windows LOLBAS
  • 15- Responding to Modern Attacks- Topics (2)
  • 16- LOLBAS Project 
  • 17- LOLBAS Project Functions
  • 18- Using the Project 
  • 19- Common LOLBAS 
  • 20- LOLBAS Example- Downloader 
  • 22- Hunting LOLBAS- Example 1 
  • 23- Hunting LOLBAS- Example 2 
  • 24- LOLBAS Hunting 
  • 25- Getting the Data, Finding the Evidence 
  • 26- Finding Evidence- Prefetch Example (1 )
  • 27- Finding Evidence- Prefetch Example (2) 
  • 28- Finding Evidence- Sysmon Event Logs 
  • 29- Finding Evidence- Windows Event Logs
  • 30- Finding Evidence- Firewall Events 
  • 31- Finding Evidence- Log Analysis
  • 32- Finding Evidence- Checking the Wire
  • 33- Ransomware 
  • 34- Ransomware- Detect the Precursors 
  • 35- Enterprise IR- Detect and Respond to Modern Attacks 
  • 36- Responding to Modern Attacks- Topics (3) 
  • 37- Improve Detection 
  • 38- Improving Security 
  • 39- Sigma Project 
  • 40- The Sigma Format 
  • 41- Sigma Example (1) 
  • 42- Sigma Example (2) 
  • 43- Writing Sigma Rules
  • 44- Writing Sigma Rules- Example (1 ) 
  • 45- Writing Sigma Rules- Example (2)
  • 46- Writing Sigma Rules- Example (3) 
  • 47- Using Sigma Rules- sigmac 
  • 48- The sigma-cli Tool 
  • 49- Using Sigma Rules- Online Conversion
  • 50- Lab 3.1 
  • 51 - Rapid Event Log Analysis 
  • 52- Introducing Hayabusa 
  • 53- Installing Hayabusa
  • 54- Using Hayabusa 
  • 55- Hayabusa Example- logon-summary 
  • 56- Hayabusa Example- csv-timeline
  • 57- Hayabusa Example- Running Specific Rules 
  • 58- Extending Hayabusa- Takajo 
  • 59- Takajo in use- Example 
  • 60- Introducing Chainsaw 
  • 61 - Using Chainsaw- Searching through Logs for a String 
  • 62- Using Chainsaw- Hunting through Logs 
  • 63- Lab 3.2 
  • 3.2 Videos "Linux DFIR"
  • 1- FOR608.3 Agenda 
  • 2- Incident Response on Linux Platforms 
  • 3- Linux DFIR Agenda (1) 
  • 4- Introducing Linux 
  • 5- What Is Linux
  • 6- Where Do You Find Linux
  • 7- The Distro Matters 
  • 8- Challenges I- The Victim System 
  • 9- Challenges II- The Responder
  • 10- Linux DFIR Agenda (2) 
  • 11- Attacker Techniques 
  • 12- Attacking Linux 
  • 13- Attacking Linux- Initial Exploitation
  • 14- Attacking Linux- Privilege Escalation 
  • 15- Attacking Linux- Persistence 
  • 16- Attacking Linux- Lateral Movement 
  • 17- Attacking Linux- C2 and Exfiltration 
  • 18- Linux DFIR Agenda (3) 
  • 19- Linux DFIR Fundamentals 
  • 20- DFIR Fundamentals- Topics (1) 
  • 21- Incident Response 
  • 22- Live Response vs. Dead Box 
  • 23- Linux File Systems (1) 
  • 24- DFIR Fundamentals- Topics (2) 
  • 25- Linux File Systems (2) 
  • 26- Determining the File System Type in Use 
  • 27- EXT3 File System
  • 28- EXT4 File System 
  • 29- XFS File System 
  • 30- File System Challenge LVM2 
  • 31 - Checking for LVM2- Examples (1)
  • 32- Checking for LVM2- Examples (2) 
  • 33- Timestamps
  • 34- The Access Timestamp 
  • 35- EXT4 Time Rules
  • 36- File System Comparisons
  • 37- Linux vs. Windows File Systems 
  • 38- File System Hierarchy 
  • 39- Linux Log Analysis 
  • 40- DFIR Fundamentals- Topics (3) 
  • 41 - Incident Response Log Strategy 
  • 42- Common Logs and Locations (1)
  • 43- Determine the Time Zone
  • 44- Common Logs and Locations (2) 
  • 45- Global System Log (1 )
  • 46- Global System Log (2) 
  • 47- Authentication and Authorization Logs
  • 48- Authorization and Privilege Use 
  • 49- Binary Login Logs
  • 50- Viewing Binary Login Files
  • 51 - Logins- wtmp Analysis 
  • 52- Logins- btmp Analysis 
  • 53- Finally- lastlog - faillog 
  • 54- lastlog Example
  • 55- Audit Logs 
  • 56- Application Logs 
  • 57- Application Logs- HTTPd 
  • 58- Web Server Logs 
  • 59- access_log 
  • 60- Quick Wins 
  • 61- Quick Wins- Example 1 
  • 62- Quick Wins- Example 2 
  • 63- Lab 3.3 
  • 64- Enterprise IR- Triage
  • 65- DFIR Fundamentals- Topics (4)
  • 66- Enterprise IR (1) 
  • 67- Enterprise IR (2) 
  • 68- Triage Analysis Guide 
  • 69- Modified User Accounts
  • 70- History Files 
  • 71 - Note on Alternative Shells and History Files
  • 72- Networking 
  • 73- Running Processes 
  • 74- Common Persistence 
  • 75- Validate SSH Access 
  • 76- Check File Modification 
  • 77- Suspicious Log Data
  • 78- Build Your Own Collection Script 
  • 79- Example Triage Script 
  • 80- Lab 3.4 
  • 3.3 Videos "Linux Hardening"
  • 1- FOR608.3 Agenda
  • 2- Linux Hardening 
  • 3- Improve the Odds 
  • 4- Improving the Odds 
  • 5- System Hardening 
  • 6- Forensic Readiness 
  • 7- Monitoring 
  • 8- Curriculum (2) 
  • 9- Contacts and Resources 
  • 4.1 Videos "macOS DFIR"
  • 1- Analyzing macOS and Docker Containers 
  • 2- Curriculum (1) 
  • 3- FOR608.4 Agenda 
  • 4- macOS Enterprise Digital Forensics & Incident Response 
  • 5- macOS Enterprise DFIR- Topics (1)
  • 6- Introduction to macOS 
  • 7- Apple Operating System Versions 
  • 8- The Enterprise Ecosystem (1)
  • 9- The Enterprise Ecosystem (2) 
  • 10- macOS Fundamentals- Apple File System (APFS) 
  • 11- macOS File and Folder Structures 
  • 12- macOS User Domain 
  • 13- macOS Fundamentals- Property List Files 
  • 14- macOS- Standard Directories 
  • 15- macOS File System Extensions 
  • 16- macOS Fundamentals- Times 
  • 17- macOS Fundamentals- Timestamps 
  • 18- macOS Enterprise DFIR- Topics (2) 
  • 19- Offline Acquisition Challenges 
  • 20- Online Acquisition Challenges 
  • 21 - Disk Acquisition- Live Collection 
  • 22- Image Mounting 
  • 23- Manual Image Mounting- macOS 
  • 24- Manual Image Mounting- Linux 
  • 25- Evidence Profiling 
  • 26- OS Version-Build Version
  • 27- Device Serial Number 
  • 28- Device Time Zone- Option 1 
  • 29- Device Time Zone- Option 2 
  • 30- User Accounts 
  • 31- Network Configuration- Interfaces 
  • 32- Network Configuration- Configuration 
  • 33- Network Configuration- DHCP 
  • 34- Lab 4.1 
  • 35- macOS File System Artifacts and DFIR 
  • 36- macOS Key File System Artifacts 
  • 37- User Shell Artifacts 
  • 38- File Artifacts- User Preferences 
  • 39- macOS Common Persistence
  • 40- Analyzing launchd- Live Response 
  • 41 - Analyzing launchd- Images and Triage Data 
  • 42- Autostart plist Example 
  • 43- Analyzing launchd Files- Workflow 
  • 44- macOS Logs and Logging
  • 45- Important Plaintext Logs 
  • 46- Binary Logs 
  • 47- Using Live Response for Log Analysis 
  • 48- Live Analysis Examples- Logged In Users 
  • 49- Live Analysis Example- Reading ASL with Syslog 
  • 50- Live Analysis Example- Using Console 
  • 51 - Binary Log Analysis on Other Platforms 
  • 52- Limitations-Considerations 
  • 53- mac_apt in Use 
  • 54- mac_apt Plugins 
  • 55- mac_apt Example 
  • 56- Lab 4.2 
  • 57- Introducing macos-UnifiedLogs 
  • 58- Using macos-UnifiedLogs as a Library 
  • 59- Standalone macos-UnifiedLogs 
  • 60- Example- unifiedlog_parser.exe 
  • 61- Example- Running parse_tracev3.exe 
  • 62- Example- Parsing theJSON Output 
  • 4.2 Videos "macOS Hardening"
  • 1- FOR608.4 Agenda 
  • 2- macOS Enterprise Hardening
  • 3- Quick Wins with macOS 
  • 4.3 Videos "Container Basics"
  • 1- FOR608.4 Agenda
  • 2- Container Basics
  • 3- What Are Containers
  • 4- Overview 
  • 5- Typical Use Cases 
  • 6- Intro to Docker 
  • 7- Example Docker Commands
  • 8- Dockerfile 
  • 9- Common Docker Attacks 
  • 10- Forensic Challenges 
  • 4.4 Videos "Container DFIR"
  • 1- FOR608.4 Agenda 
  • 2- DFIR Workflow- Live Response- Running Containers 
  • 3- Step 1- Collect Metadata 
  • 4- Metadata Collection- Docker Environment 
  • 6- Metadata Collection- Identify Available Images
  • 5- Metadata Collection- Docker Host Info 
  • 7- Metadata Collection- Image Build History 
  • 8- Metadata Collection- Inspect the Image 
  • 9- Metadata Collection- Identify Running Containers 
  • 10- Metadata Collection- Inspect the Container 
  • 11 - Step 2- Capture Snapshot from a Container
  • 12- Lab 4.3 
  • 13- Step 3- Collect Logs 
  • 14- Collect Internal Data 
  • 15- Note on Container Logs 
  • 16- Docker Logging Output 
  • 17- Step 4- Check Running Processes
  • 18- Step 5- Gather Triage Data 
  • 19- Step 6- Review the Images
  • 20- Where Is the Evidence
  • 21- Loading Images 
  • 22- Extracting Evidence 
  • 23- Check the Build History- Image in Registry 
  • 24- Check Build History- tarfile Image on Disk
  • 25- Identify Layers of Interest- tarfile Image on Disk 
  • 26- Extract Files- tarfile Image on Disk 
  • 27- Lab 4.4 
  • 28- Docker Summary
  • 29- Curriculum (2)
  • 30- Contacts and Resources 
  • 5.1 Videos "Cloud Infrastructure & Response"
  • 1 - Cloud Attacks and Response 
  • 2- Curriculum (1) 
  • 3- 608.5 Agenda
  • 4- Cloud Infrastructure and Response 
  • 5- Cloud Service Models
  • 6- Cloud Forensics vs. Traditional Forensics
  • 7- Six-Step Incident Response Process 
  • 8- MITRE ATT&CK® Cloud Matrix
  • 5.2 Videos "M365 and Azure"
  • 1- 608.5 Agenda 
  • 2- M365 and Azure 
  • 3- Products 
  • 4- Products- From 0365 to M365 
  • 5- From Azure AD to Entra ID 
  • 6- Entra ID (Azure AD) Hybrid Authentication Options 
  • 7- Entra ID and On-Prem AD Password Hash Sync 
  • 8- Attack Scenarios 
  • 9- Spear Phishing to Full Domain Compromise 
  • 10- New Accounts and Delegations 
  • 11 - Classical BEC with a Twist 
  • 12- Forwarding Rules
  • 13- Bypass MFA I- Pass the Cookie 
  • 14- Bypass MFA II- Pass the PRT 
  • 15- Registering Additional Sync Device 
  • 16- Abusing OAuth 
  • 17- SharePoint Online as Attack Infrastructure
  • 18- Log Sources 
  • 19- M365 Unified Audit Logs (UAL)
  • 20- Log Retention 
  • 21- Entra Sign-In Log 
  • 22- Entra Audit Log 
  • 23- Entra Audit Log- User 
  • 24- Entra Audit Log- Group 
  • 25- Entra Audit Log- Application 
  • 26- Entra ID Provisioning Logs
  • 27- Microsoft Defender for Cloud Apps 
  • 28- Log Acquisition 
  • 29- Preliminary Steps- Acquisition Account
  • 30- Acquisition Methods 
  • 31- DFIR-0365RC 
  • 32- Office-365-Extractor 
  • 33- Micrsosoft-365-Extractor-Suite
  • 34- Microsoft Graph API 
  • 35- Analysis Use Cases 
  • 36- Built-In Reports 
  • 37- Built-In Risk Detection 
  • 38- Investigate and Profile Logons- Successful Login 
  • 39- Investigate and Profile Logons- Brute Forcing 
  • 40- Lab 5.1 
  • 41 - Investigate and Profile Logons- MFA 
  • 42- Investigate Newly Added Users 
  • 43- Investigate Mailbox Access and Delegation 
  • 44- Investigate Forwarding Rules 
  • 45- Investigate OAuth Abuse 
  • 46- Securing M365 and Azure 
  • 47- Out of the Box Security Features
  • 48- Making Forensics Easier 
  • 49- Decoys 
  • 5.3 Videos "Attacker Cloud Infrastructure"
  • 1- 608.5 Agenda 
  • 2- Attacker Cloud Infrastructure 
  • 3- Reasoning 
  • 4- Exfiltration Process in Ransomware Attacks (1) 
  • 5- Exfiltration Process in Ransomware Attacks (2) 
  • 6- Exfiltration Process in Ransomware Attacks (3) 
  • 7- How to Get to This Point 
  • 8- Know What You Search for, and You Shall Find It 
  • 9- Bulk Extractor Scales Now 
  • 10- Putting It Together 
  • 11- Lab 5.2A 
  • 12- Lab 5.2B 
  • 5.4 Videos "AWS Foundations"
  • 1- 608.5 Agenda 
  • 2- A Brief History of AWS 
  • 3- AWS Foundations (1 ) 
  • 4- Hierarchy of an AWS Deployment 
  • 5- AWS Users
  • 6- AWS Roles and Secure Tokens 
  • 7- AWS Authentication and Access 
  • 8- Credentials via the Instance Metadata Service 
  • 9- Querying the Instance Metadata Service 
  • 10- Case Study- Capital One Compromise via Instance Metadata 
  • 11 - Instance Metadata Service Today 
  • 13- AWS Regions and API Endpoints 1 
  • 14- Amazon Resource Names (ARN) 
  • 15- AWS Cloud Networking Constructs 
  • 17- AWS Storage Constructs 
  • 18- S3 in the News for the Wrong Reasons 
  • 5.5 Videos "AWS Response and Analysis"
  • 1- 608.5 Agenda 
  • 2- Incident Response in AWS 
  • 3- AWS Security Incident Response Guide 
  • 4- AWS Shared Responsibility Model 
  • 5- AWS Incident Domains 
  • 6- Detection and Response Resources in AWS 
  • 7- AWS Log Analysis 
  • 8- CloudTrail Logs Overview 
  • 9- CloudTrail Log Format 
  • 10- Example CloudTrail Event (Console Login Event) 
  • 11- Logging Data Access in S3 Buckets 
  • 12- Anomaly and Threat Detection Services in AWS 
  • 13- AWS CloudWatch 
  • 14- AWS Guard Duty 
  • 15- Analysis with Amazon Detective 
  • 16- Lab 5.3 
  • 17- AWS Network Analysis 
  • 18- AWS VPC Flow Logs 
  • 19- VPC Traffic Mirroring 
  • 20- Analysis in AWS 
  • 21 - Architecting for Analysis in the Cloud 
  • 22- Acquire Access to AWS Accounts in the Organization 
  • 23- Utilize Dedicated Security Accounts 
  • 24- Build Remote Analysis Environment 
  • 25- Plan for Evidence Acquisition and Storage
  • 26- Leveraging the AWS Systems Manager Agent (SSM Agent) 
  • 27- Practice Likely Scenarios 
  • 28- Example Scenario- Respond to a Compromised EC2 Instance 
  • 29- Create a Volume from the Snapshot 
  • 30- Mount the Snapshot Volume to an Analysis EC2 Instance 
  • 31 - Attach the Snapshot Volume to the Analysis EC2 Instance 
  • 32- Begin Analysis on Snapshot Volume 
  • 5.6 Videos "IR Automation in the Cloud"
  • 1- 608.5 Agenda
  • 2- IR Automation in the Cloud 
  • 3- Targets for Automation 
  • 4- Leverage Existing AMIs for Forensic Analysis 
  • 5- Automation in AWS- Deployment 
  • 6- Automation in AWS- Serverless Code with Lambda 
  • 7- Automation in AWS- Step Functions 
  • 8- Generalized IR Automation for the Cloud 
  • 9- Summarizing Incident Response in the Cloud 
  • 10- Lab 5 .4 
  • 11 - Intrusion Forensic Challenge 
  • 12- Curriculum (2) 
  • 13- Contacts and Resources 
Reglas de finalización
  • Todas las unidades deben ser completadas
Atrás