Incident Handling & Response

درباره‌ی این دوره

این دوره به چه افرادی توصیه می‌شود؟

• تحلیل‌گران و مهندسین SOC
• کارشناسان فناوری اطلاعات سازمان‌ها
• کارشناسان پاسخ‌گویی به تهدیدات سایبری (CSIRT)
• مشاورین امنیت سایبری
• کارشناسان تست نفوذ/تیم قرمز که قصد دارند با راهکارهای تیم‌های دفاعی و تیم‌های آبی بیشتر آشنا شوند

برای حضور در این دوره چه دانش‌هایی باید داشته باشم؟

• آشنایی با سیستم‌عامل‌های ویندوز و لینوکس
• آشنایی با پروتکل‌های TCP/IP
• آشنایی با تحلیل وقایع و لاگ
• آشنایی با اصول تحلیل ترافیک

• Introduction to Incident Handling
  • Incident Handling Overview
    • What is an Incident?
    • What is Incident Handling & Incident Responding?
  • Cyber Kill Chain Overview
  • Incident Handling Process
    • Preparation
    • Identification
    • Containment
    • Eradication
    • Recovery
    • Incident Record-keeping
  • Post-Incident Activities and Follow-Up
• Network Security Incidents Handling and Responding
  • Network Concepts & Analysis
    • Communication Models
    • TCP / IP
    • Traffic Analysis Tools
  • Analyzing & Detecting Link Layer Attacks
    • Network Link Layer Overview
    • ARP Attacks Detection
    • Sniffing Attacks Detection
    • Wireless Attacks Detection
  • Analyzing & Detecting IP Layer Attacks
    • Network IP Layer Overview
    • IPv4 Packet Overview
    • Abusing Fragmentation Detection
    • IPv6 Packet Overview
    • Abusing IPv6 Fragmentation Detection
    • IPv4 & IPv6 Tunneling
    • ICMPv4 & ICMPv6 Attacks Detection
  • Analyzing & Detecting Transport Layer Attacks
  • Network Transport Layer Overview
    • TCP Based Attacks Detection
    • UDP Based Attacks Detection
  • Detecting Common Application Protocol Attacks
    • Microsoft-specific Protocols
    • HTTP Based Attacks
    • HTTP
    • HTTPS
    • SMTP
    • DNS
• Handling and Responding to Reconnaissance Activities
  • Reconnaissance/Information Gathering Overview
  • Reconnaissance Techniques
    • Whois
    • SSL Certificate Information Analysis
    • Search Engines
    • Shodan and other Internet-Wide Scanners
    • DNS Interrogation
    • Abusing Exposed OWA or Lync
    • JavaScript Injection
    • Aggregate OSINT data collection with SpiderFoot
  • Scanning
    • Scanning Techniques
    • Nmap/Masscan
    • War Dialing
    • Locating and attacking personal and enterprise Wi-Fi
    • WebRTC-based Scans
• Handling and Responding to Exploitation Attacks
  • Exploitation Overview
    • Local Exploits
    • Remote Exploits
  • Exploit Microsoft Products and Services
    • NetNTLM Hash Capturing & Relaying
    • Microsoft Office Exploits
    • Malicious Macros
    • SMB Exploits
    • IIS Exploits
    • SharePoint Exploits
  • Remote Linux Host Attacks
    • Password Spraying
    • Samba Vulnerabilities & Misconfigurations
    • Shellshock
    • Java RMI Registry Exploitation
    • Exploiting Insecure Java Deserialization
  • Denial of Service Attacks
    • DoS Exploits
    • DNS Amplification Attacks
    • Botnet-based Attacks
  • BGP Hijacking
  • SSL Attacks
    • Heartbleed
    • SSL Stripping
    • Sslstrip+
• Handling and Responding to Post-Exploitation Attacks
  • Post-Exploitation Attacks Overview
  • Windows Privilege Escalation
    • Stored Credentials
    • Insufficiently Secure Service Registry Permissions
    • Unquoted Service Path
    • Insufficiently Protected Service Binary
    • Always Install Elevated
    • Exploiting the Windows Kernel and 3rd-Party Drivers for Privilege Escalation
    • Abusing Windows Privileges for Privilege Escalation
  • Linux Privilege Escalation
  • Credential Theft
    • Mimikatz
  • Privilege Escalation Using Active Directory Protocols and Misconfigurations
    • Windows Authentication Weaknesses
    • SMB Relay
    • Pass the Hash
    • Pass the Ticket
    • Forged Kerberos Tickets
    • SPN Scanning
    • DCSync
    • DCShadow
    • Password Spraying
    • Remote Command Execution
    • Windows Persistence
    • Linux Persistence
• Log Analysis
  • Windows Logging
    • Account Management Events
    • Account Logon and Logon Events
    • Access to Shared Objects
    • Scheduled Task Logging
    • Object Access Auditing
    • Audit Policy Changes
    • Process Tracking
    • Auditing PowerShelI
  • Web Servers Logging
    • IIS Logging
    • Apache Logging
    • ENGINX Logging
  • Linux Logging
  • Network Devices Logging
• Protocol Based Attacks Analysis
  • SMTP Analytics
    • Phishing Domain Identification
    • Malicious Attachment Identification
  • DNS Analytics
    • Detecting DNS Tunneling
  • HTTP(S) Analytics
    • HTTP Analytics
    • HTTPS Analytics

گواهینامه‌ی دوره