گواهینامه‌ی دوره

برای دریافت گواهینامه‌ی این دوره، ده روز پس از جلسه‌ی پایانی، آزمونی برگزار خواهد شد که با قبولی در این آزمون، امکان صدور گواهینامه‌ی دوره برای شما را خواهیم داشت. حضور در آزمون پایانی و دریافت گواهینامه‌ی دوره برای شرکت‌کنندگان اختیاری است.

هزینه‌ی چاپ و صدور گواهینامه‌ی دوره: ۵۰ هزارتومان

این دوره به چه افرادی توصیه می‌شود؟

• متخصصان امنیت سایبری
• نفوذگران وب و شبکه
• کارشناسان تیم بنفش
• کارشناسان شکار تهدیدات
• کارشناسان مدیریت رخداد
• کارشناسان تیم مرکز عملیات امنیت

برای حضور در این دوره چه دانش‌هایی باید داشته باشم؟

حداقل دو سال سابقه در زمینه‌ی دفاعی یا حملات

سرفصل‌های دوره

Chapter 1: Introduction to Purple Teaming

1.1 What is Red Teaming

1.2 What is Blue Teaming

1.3 What is Purple Teaming

Chapter 2: Structure of an Advanced Persistent Threat (APT)

2.1 Chain of an Attack

2.2 MITRE comes to rescue

2.3 MITRE ATT&CK (Simulation)

2.4 Lab: Find a new (for you) interesting technique

2.5 MITRE Shield (Detection)

2.6 Lab: Write your detection hypothesis around the new technique

Chapter 3: Initial access Emulation, Detection and Prevention

3.1 Legitimate binaries

3.2 Lab: Find and Use a  LOLBin

3.3 Common techniques (DLL side loading, Scriptlet, XSL, Macro, DDE, JS, VBA)

3.4 Lab: Write a script for detecting DLL side loading

3.5 Lab: Mitigate Macro usage in Enterprise

3.6 Lab: Prevent Macro execution in Enterprise

3.7 Lab: Prevent JS/HTA execution in Enterprise

3.8 Fileless download and execution

3.9 Lab: Disabling Windows Script Host (WSH) in your organization

3.10 Bypass application control and whitelisting

3.11 Credential Harvesting Attacks

3.12 Lab: Find a Credential Harvesting Attack against a Cryptocurrency company

3.13 Domain Masquerading

3.14 Lab: Find a Domain Masquerading Attack against your organization

3.15 NTLM Relaying

3.16 Lab: Stopping NTLMv2 related attacks

3.17 Payload Packs (ISO, MSI)

3.18 Lab: Build your own Payload

3.19 Lab: Prevent ISO Mount in Enterprise

Chapter 4: Enumeration Emulation, Detection and Prevention

4.1 RAW LDAP queries

4.2 IN-Memory WMI

4.3 Internal Reconnaissance with WinAPI

4.4 Lab: Write a code to get system information

4.5 Low noise host, group, ACL, user, policy, AD Controls, enumeration

4.6 Sessions

4.7 Password policies

4.8 Machine Account

4.9 Certificates

Chapter 5: Privilege Escalation Emulation, Detection and Prevention

5.1 Service Hijacking

5.2 File System

5.3 Registry

5.4 Delegation

5.5 LAPS

5.6 Targeted Kerberoasting

5.7 GMSA

5.8 Name Pipes

Chapter 6: AD and Local persistent Emulation, Detection and Prevention

6.1 Service and Service Triggers

6.2 Task Scheduler

6.3 Registry

6.4 DLL Sideloads

6.5 Autoruns

6.6 COM Object Model

6.7 COM Interactions

6.8 COM Hijacking

6.9 Lab: Write a script for detecting COM Hijacking (should handle 2 of known variants)

6.10 COM Backdoors and Persistence

6.11 ACL and Security Descriptors

6.12 Abuse Kerberos for Persistent

Chapter 7: Advanced Active Directory Domain Attacks

7.1 The Kerberos Realm

7.2 S4U2self Abuse AS-REP Roasting

7.3 Golden Tickets

7.4 Silver Tickets Attacks

7.5 Command execution on silver ticket

7.6 NO AD Touch Kerberos Attacks

7.7 Pass the Ticket

7.8 ACL, SACL, DACL and GPO Abuse

7.9 DCShadow

7.10 Abusing vulnerable services

7.11 Abuse AD rights

7.12 Preventing Wiper/Ransomware with Sysmon’s new feature

Chapter 8: Lateral Movement

8.1 SMB and RPC Pivoting

8.2 WinRM and PowerShell Pivoting

8.3 Fileless WMI Queries and WMI Execution

8.4 Service Diversion

8.5 Socks Tunneling

8.6 Remote Desktop

Chapter 9: Defense Evasion

9.1 Event Tracing for Windows (ETW) bypasses

9.2 Application Whitelisting bypasses

9.3 VBA stomping

9.4 HTML smuggling

9.5 Parent Process Id (PPID) spoofing

9.6 Endpoint Detection and Response (EDR) Evasion

9.7 Environmental Keying

9.8 Attack Surface Reduction (ASR) bypasses

9.9 Command-Line Spoofing

9.10 Process Injection

Chapter 10: Build Your Emulation Plan

10.1 Pick Your Favorite APT

10.2 Emulate the APT

10.3 Detect the APT

10.4 Mitigate the APT

Chapter 11: Introduction to security mechanisms and tools

11.1 WDAC

11.2 CLM

11.3 ASR rule

11.4 EDR

11.5 YARA

Chapter 12: Setup your RED – Blue LAB

12.1 C2

12.2 Elastic

Chapter 13: Emulating real-world APTs and cyber criminals

APT 27: ProxyLogon -> Local and Domain Discovery -> DLL Search Order Hijacking -> Service (for Persistence)  -> Indicator Removal  -> Add Exclusion to Windows Defender -> Dumping LSASS -> NTDS -> Data Collection -> Exfiltration

APT 28: Latest TTPs!

Lazarus: Malicious Document (was sent via LinkedIn) -> LNK -> MSHTA -> VBScript -> Startup (for Persistence) -> PowerShell  -> Disable Windows Defender -> Disable Credential Guard -> Credential Access -> Next Stage -> SSP (for Persistence) -> Indicator Removal

APT 29: Latest TTPs!

Emotet : LNK -> PowerShell -> Regsvr32 -> Local and Domain Recon -> Run Key -> Remote Management Tool -> Service Creation -> AnyDesk -> Zerologon -> Indicator Removal -> Dumping LSASS -> Remove Service -> WMI -> RDP -> Ransomware