عرفان باقری‌اول

• متوسط مقدماتی
• مسیر آبی
• ۴ درس

دربارۀ این دوره

مخاطبان

• کارشناسان Service Desk
• کارشناسان مرکز عملیات امنیت سطح ۱(SOC T1)
• کارشناسان مرکزعملیات امنیت سطح ۲(SOC T2)
• کارشناسان پاسخ به رخداد (IR)
• کارشناسان شکار تهدید (TH)
• کارشناسان تست و نفوذ شبکه

پیش‌نیازها

• دوره +Network
• دوره +Security

• DNS as a Security Control Plane: Architecture, Auditing & Defense
  • Enterprise DNS architecture from a defender-centric perspective
  • Windows DNS roles, zone types, record behavior, and trust relationships
  • Mapping the DNS attack surface across internal enterprise environments
  • Identifying misconfigurations that increase exposure or weaken control
  • Designing secure zones, enforcing transfer restrictions, and governing recursion
  • Building effective DNS logging and auditing for security visibility
  • Detecting anomalous query patterns, tunneling, beaconing, and abuse
  • Using DNS telemetry for threat hunting, triage, and incident scoping
  • Correlating DNS activity with host and identity signals for deeper investigation
• Active Directory Identity Defense & Privilege Containment
  • Decoding Active Directory architecture from a defender-centric perspective
  • Securing Domain Controllers as Tier-0 critical infrastructure assets
  • Deconstructing authentication internals: Kerberos, NTLM, and LDAP trust flows
  • Mapping privilege delegation models to eliminate administrative risk concentration
  • Architecting high-value account protection and secure administration blueprints
  • Weaponizing Group Policy as an active security control plane
  • Hardening RSAT operations and eliminating management surface exposure
  • Identifying and blocking credential harvesting vectors in domain environments
  • Exposing Active Directory attack paths and engineering defender visibility points
  • Hardening AD DS for identity containment, recovery readiness, and post-compromise survival
• IIS Defense in Depth: Secure Configuration, Logging & Threat Detection
  • Decoding IIS architecture from a defender-centric perspective
  • Securing IIS servers as internet-exposed application delivery assets
  • Deconstructing worker process behavior, application pools, and execution boundaries
  • Designing application pool identities to enforce privilege isolation and reduce compromise impact
  • Hardening web content paths, permissions, and file upload surfaces against code execution risk
  • Engineering request filtering controls to reduce attack surface and restrict malicious execution paths
  • Building IIS logging visibility for investigations, anomaly detection, and forensic reconstruction
  • Identifying suspicious request patterns, web shell activity, and post-exploitation artifacts in IIS environments
• Windows Telemetry Engineering: From Native Logs to Sysmon-Driven Detection
  • Decoding Windows logging architecture and the event generation pipeline from source to storage
  • Navigating core log channels across Security, System, Application, PowerShell, DNS, and operational sources
  • Designing Advanced Audit Policy for enterprise-grade monitoring, accountability, and investigative coverage
  • Prioritizing high-value Windows events for authentication, privilege use, process activity, and access control
  • Building investigative context from native Windows Event Logs to support threat hunting and incident review
  • Engineering Sysmon deployment and configuration for scalable telemetry, visibility, and detection readiness
  • Exposing process creation, command-line, network, registry, file, DNS, WMI, and named-pipe activity at endpoint depth
  • Analyzing Sysmon event IDs for persistence, execution, tampering, and lateral movement techniques
  • Detecting process injection, suspicious parent-child chains, and LOLBin abuse in enterprise environments
  • Tracking file creation, deletion, alternate data streams, and anti-forensics behavior through endpoint teleme
  • Surfacing WMI persistence and host-based command-and-control activity through targeted visibility engineering
  • Interpreting Windows Filtering Platform events including blocked connection telemetry and network enforcement signals
  • Leveraging PowerShell scripting to automate event log collection, filtering, and parsing across enterprise hosts
  • Developing custom PowerShell tools and automated hunting scripts to query Sysmon and event logs for Indicators of Compromise (IoCs)
  • Correlating Windows logs and Sysmon data to reconstruct attacker behavior across the kill chain
  • Tuning telemetry and alert fidelity to reduce noise, improve signal quality, and strengthen detection outcomes