این دوره به چه افرادی توصیه می‌شود؟

• تحلیل‌گران و مهندسین SOC
• کارشناسان ارزیابی امنیت/تست نفوذ/تیم قرمز
• کارشناسان پاسخ‌گویی به تهدیدات سایبری
• شکارچیان تهدیدات سایبری
• مشاورین امنیت سایبری
• علاقه‌مندان به تیم بنفش (Purple Team)

برای حضور در این دوره چه دانش‌هایی باید داشته باشم؟

• آشنایی با مفاهیم انواع حملات سایبری
• آشنایی با سیستم‌عامل‌های ویندوز
• آشنایی با پروتکل‌های TCP/IP
• آشنایی با مفاهیم تحلیل وقایع و لاگ
• حداقل ۲ سال سابقه‌ی فعالیت در زمینه‌ی امنیت سایبری

سرفصل‌های دوره

Chapter 1: APT

1.1 What is an APT attack?

1.2 APT Core Tactics

1.3 APT Attack Lifecycle

1.4 Real world APT Attacks

1.5 Red Team Tools 

1.6 Why Threat Hunting

1.7 EDR, SOC, SIEM, Antivirus Can be Bypassed

Chapter 2: Incident Response & Threat Hunting in common

2.1 Incident Response

2.2 How to Catch Bad Guys (SOC, Threat Hunting, Tools)

2.3 Security Controls and Types of Logs in an Organization

2.4 Incident Response Preparation

Chapter 3: Tools

3.1 Useful Audit Policies

3.2 Build Our Tools with PowerShell

3.3 Ravin Hunting Tools

3.4 Sysmon and Configurations

3.5 Harden Your Sysmon:)

3.6 EDR

3.7 Event Viewer and ETW

Chapter 4: Hunting APTs Core Tactics

4.1 Initial Access

4.1.1 malicious Attachment

4.1.2 Advanced Execution Techniques

4.1.3 Password Spray

4.1.4 Analyze Attacks Using sysmon & Splunk OR Elastic

4.1.5 Phishing

4.2 Persistence

4.2.1 DLL Proxy DLL Hijacking

4.2.2 Logon Scripts

4.2.3 Screensavers

4.2.4 Scheduled Tasks Elevated Multi-Action

4.2.5 SSP and Authentication Packages

4.2.6 Application Shims

4.2.7 Registry (Not Just Run Keys)

4.2.8 WMI Event Subscriptions

4.2.9 Active Directory Persistence

4.2.10 Golden Ticket Hunting

4.3 Lateral Movement

4.3.1 Hunting Impacket for Lateral Movement

4.3.2 Remote Service and SCM

4.3.3 Remote Schedule Task

4.3.4 Remote Registry

4.3.5 Name Pipes

4.3.6 PowerShell for Lateral Movement

4.3.7 Customized Psexec (Service, Pipe rename)

4.3.8 Com Objects for Lateral Movement

4.4 Credential Attacks

4.4.1 LSASS Memory Read Advance Detection

4.4.2 Dumping NTDS Detection

4.4.3 Hunting Native DLLs and Tools for Credential Dumping

4.4.4 DCSync and Stealthy DCSync

4.4.5 Abusing ACLs, SACL and Active Directory Rights

4.4.6 Unconstrained Delegation

4.4.7 Hunt What Your SIEM dos not Detect for Credential Dump

4.4.8 MiniDump WriteDump

4.4.9 Token Impersonation Hunt

4.4.10 Hunt Stealthy usage of Impacket for Credential Dump

4.4.11 Implementing Credential Guard & Powered Use

4.4.12 Pass the Hash

4.5 Execution and Defense Evasion

4.5.1 Malware Defense Evasion Techniques

4.5.2 Process Injection

4.5.3 Use of Legitimate Applications

4.5.4 Disguise Malware Using COM Objects

4.5.5 Detecting & Preventing the Abuse of the Legitimate Applications

4.5.6 Sysmon & ​EDR Bypass Techniques

4.6 Recon and Discovery

4.6.1 LDAP Hunting (Powerview, Bloodhound, …)

4.6.2 User and Group Enumeration Hunting

4.6.3 Decoy

4.6.4 Hunt Registry for Recon Purpose

4.7 In-Depth Investigation & Forensics

4.8 Incident Response in an Enterprise

4.8.1 Intro to PowerShell

4.8.2 PowerShell Remoting

4.8.3 Collect & Analyze Malicious

4.8.4 Collect Minidumps Using PowerShell

4.8.5 Detect Suspicious Processes Using PowerShell

4.8.6 Automating Artifacts Collection & Analysis for Threat Intelligence

4.8.7 Convert Your Threat Hunting Hypothesis into an Alert

4.8.8 Write Your Own SIGMA Rules

4.9 Malware Privilege Escalation Techniques

4.9.1 UAC Bypasses Using Legitimate Apps

4.9.2 UAC Bypasses Using COM Objects

4.9.3 UAC Bypasses Using Shimming

4.9.4 Abusing Services for Privilege Escalation

4.9.5 DLL Order Hijacking

4.9.6 Privilege Escalation to SYSTEM