Penguin Detectives

علیرضا کلانترزاده

• پیشرفته
• مسیر آبی
• ۱۱ درس

دربارۀ این دوره

مخاطبان

• کارشناسان لایۀ ۲ و ۳ مرکز عملیات امنیت
• کارشناسان فعال در حوزۀ شکار تهدید
• کارشناسان فعال در حوزۀ جرم‌شناسی سایبری

پیش‌نیازها

• آشنایی با سیستم‌عامل لینوکس
• تجربۀ حداقل یک سال در حوزۀ امنیت سایبری

• Linux Fundamental
  • Linux History
  • Linux Distros
  • Windows Subsystem for Linux
  • Directory Structure
  • File and Directory Permissions
  • Users and Groups
  • Shells and Command History
  • Linux Services & Daemons Overview (Web Server , DataBases , Firewalls , …)
• Linux Internals
  • Linux Architecture
  • ELF
  • Kernel Modules Fundamentals & Rootkit Structures
  • Compile a Linux Kernel
  • Process and Thread Fundamentals
  • Essential Tools for Linux Debug
  • Memory Management
  • Process Signals
  • Virtual File System
  • Linux File Systems
  • ext2
  • ext3
  • ext4
  • XFS
  • OpenZFS
  • Btrfs
• Forensics Fundamental
  • Linux Forensic Investigation Operations
  • Handling Security Incidents in Linux2
• Linux Logs
  • Authentication and Security
  • Syslog and Kernel
  • Web Server
  • Firewall
  • Auditd and Sysmon for Linux
  • Custom Log in Linux
• Persistence Techniques in Linux
  • Systemd timers
  • Cron jobs
  • Init.d and system services
  • SSH Keys
  • Shell Settings Files
  • Package Manager
  • Privileged user
  • RootKits (User Mode and Kernel Mode)
  • Persist with PAM
  • Rc.local
  • Pre Load library
  • ACL Persistence
  • Hidden Process
  • Using BPF for persistence
  • Additional Techniques
• Live Data Collection & Evidence Gathering in Linux
  • Memory and Disk Capture
  • Collecting data form os
• Mastering Linux Forensic Tools
  • dd , dc3dd , dcfldd
  • UAC
  • Volatility
  • Bulk Extractor
  • Writing Custom Script for Collecting Data
• Timelining
  • Using Plaso with Log2Timeline
  • The Sleuth Kit
• Linux Memory Forensic
  • Installing Volatility 2 and 3
  • Create Profile for volatility 2 and 3
  • Process Enumeration
  • Command History
  • Network Activity
  • Code Injection
  • Loaded Kernel Modules
  • Dumping Memory
  • Other useful Plugins
• Interactive Linux Forensics Lab
• Investigating Real Infections
  • Apt 36 Samples
  • Camaro dragon
  • Iron Tiger
  • HiddenWasp Malware
  • Apt 28 Samples
  • BPFDoor

گواهینامه‌ی دوره