Threat Hunting Using Sysmon

مهدی میرسلطانی

• متوسط
• مسیر آبی
• ۷ درس

درباره‌ی این دوره

این دوره به چه افرادی توصیه می‌شود؟

• کارشناسان شکار تهدیدهای سایبری
• افراد علاقه‌مند به امنیت شبکه‌های مبتنی‌بر ویندوز
• مشاوران امنیت سایبری
• کارشناسان امنیت سایبری در سازمان‌ها و بخش SOC

برای حضور در این دوره چه دانش‌هایی باید داشته باشم؟

• برای حضور در این کارگاه نیاز است تا با زیرساخت‌های مبتنی‌بر مایکروسافت و سیستم‌عامل ویندوز آشنایی داشته باشید. مهم‌ترین پیش‌نیازهای دانشی و تجربی برای حضور در این دوره به شرح زیر است:
• آشنایی با سیستم‌عامل ویندوز
• آشنایی با مفاهیم حمله‌های سایبری در زیرساخت شبکه
• آشنایی با مفاهیم شبکه و پروتکل‌ها

• Structure and Chain of Advanced Attack
  • Cyber Kill Chain
  • Diamond Model
  • LNK File Leads to Domain Wide Ransomware
  • APT in Real World
  • APT 27 Analysis
  • We need a common language: MITRE ATT&CK
• Dive To Threat Hunting
  • What Is Threat Hunting
  • Assume Breach
  • Post Exploitation
  • Security Monitoring vs. Threat Hunting
  • What Threat Hunting is NOT!
  • Sqrrl Hunt Maturity Model
  • Hunt Maturity Model – Components
  • Desired Threat Hunting Experience – Skillsd
• Advanced - Defensive
  • Glance To Sysmon Sysinternals
  • Sysmon Installation
  • Data Shippers
  • Log Forwarding
  • Elastic Infrastructure
  • Review - Data Sources
  • Review - Data Sensors
  • Data Governance
  • What is a data model?
  • Data Modeling Mapped to Adversary
  • Lateral Movement via WMI
• Sysmon Telemetry
  • Intro To ETW
    • Logman For Analysis
  • What Is Process
    • Thread
    • Token
    • SACL
    • Access
  • Windows API call
  • Kernel Callback
• Sysmon Event IDs
  • Process creation
  • A process changed a file creation time
  • Network connection
  • Sysmon service state changed
  • Process terminated
  • Driver loaded
  • Image loaded
  • Create Remote Thread
  • Raw Access Read
  • Process Access
  • File Create
  • Registry Event (Object create and delete)
  • Registry Event (Value Set)
  • Registry Event (Key and Value Rename)
  • File Create Stream Hash
  • Service Configuration Change
  • Pipe Event (Pipe Created)
  • Pipe Event (Pipe Connected)
  • Wmi Event (Wmi Event Filter activity detected)
  • Wmi Event (Wmi Event Consumer activity detected)
  • Wmi Event (Wmi Event ConsumerToFilter activity detected)
  • DNS Event (DNS query)
  • File Delete (File Delete archived)
  • Clipboard Change (New content in the clipboard)
  • Process Tampering (Process image change)
  • FileDeleteDetected (File Delete logged)
  • FileBlockExecutable
  • FileBlockShredding
  • FileExecutableDetected
• Sysmon Configuration
  • Rule create
  • Rule Group
  • Filter Events
  • Event Tags
  • How Attackers Bypass Sysmon
  • Hooking API Calls
  • Sysmon Driver
• Threat Hunting With Sysmon
  • Hunting Lateral Movement Techniques
    • Named Pipe pivoting
    • DCOM
    • WinRM – Brute Ratel C4
  • Hunting Persistent Techniques
    • Windows Management Instrumentation (WMI) - Metador APT
    • COM Object Hijacking – Turla APT
    • UserInitMprLogonScript – APT28
    • Other Techniques
  • Hunting Credential Access Techniques
    • PPLDump
    • Inject SSP
    • LSASS Dump
    • Other Techniques
  • Hunting what others don’t want you to know
    • Hunting wiper/ransomware activity observed in Russia-Ukraine conflict
    • Printnightmare
    • Microsoft.BackgroundIntelligentTransfer.Management.Interop.dll for BITS Activity
  • lolbas
    • sftp.exe – DeathStalker APT
    • certutil.exe – APT28
    • mshta.exe - Lazarus/APT38 cluster
  • APT Attacks – Analyzing the Full Chain
    • Analyzing latest Tactics, Techniques, and Procedures (TTPs) of two different APTs.
  • Process Injection Hunting
    • What is process injection
    • apc queue injection
  • Loading and Execute Command with System.automation.dll

گواهینامه‌ی دوره