FOR508: SANS Cyber Security Central: May 2023

Provided by

Enquire about this course

What You Will Learn

Threat hunting and Incident response tactics and procedures have evolved rapidly over the past several years. Your team can no longer afford to use antiquated incident response and threat hunting techniques that fail to properly identify compromised systems, provide ineffective containment of the breach, and ultimately fail to rapidly remediate the incident or contain propagating ransomware. Incident response and threat hunting teams are the keys to identifying and observing malware indicators and patterns of activity in order to generate accurate threat intelligence that can be used to detect current and future intrusions. This in-depth incident response and threat hunting course provides responders and threat hunting teams with advanced skills to hunt down, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and ransomware syndicates.

FOR508: Advanced Incident Response and Threat Hunting Course will help you to:
  • Understand attacker tradecraft to perform compromise assessments
  • Detect how and when a breach occurred
  • Quickly identify compromised and infected systems
  • Perform damage assessments and determine what was read, stolen, or changed
  • Contain and remediate incidents of all types
  • Track adversaries and develop threat intelligence to scope a network
  • Hunt down additional breaches using knowledge of the adversary
  • Build advanced forensics skills to counter anti-forensics and data hiding from technical subjects
The course exercises and final challenges illustrate real attacker traces found via end point artifacts, event logs, system memory, and more:
  • Phase 1 - Patient zero compromise and malware C2 beacon installation
  • Phase 2 - Privilege escalation, lateral movement to other systems, malware utilities download, installation of additional beacons, and obtaining domain admin credentials
  • Phase 3 - Searching for intellectual property, network profiling, business email compromise, dumping enterprise hashes
  • Phase 4 - Find exfiltration point, collect and stage data for theft
  • Phase 5 - Exfiltrate files from staging server, perform cleanup and set long-term persistence mechanisms (alternatively this phase would be used to deploy ransomware)
Business Takeaways:
  • Understand attacker tradecraft to perform proactive compromise assessments
  • Upgrade detection capabilities via better understanding of novel attack techniques, focus on critical attack paths, and knowledge of available forensic artifacts
  • Develop threat intelligence to track targeted adversaries and prepare for future intrusion events
  • Build advanced forensics skills to counter anti-forensics and data hiding from technical subjects for use in both internal and external investigations
Should a breach occur, FOR508 graduates will have the skills to:
  • Detect how and when attack happened
  • Quickly identify compromised and infected systems
  • Perform damage assessments and determine what was read, stolen, or changed
  • Contain and remediate incidents
  • Hunt down additional breaches using knowledge of the adversary
You Will Be Able To
  • Learn and master the tools, techniques, and procedures necessary to effectively hunt, detect, and contain a variety of adversaries and to remediate incidents.
  • Detect and hunt unknown live, dormant, and custom malware in memory across multiple Windows systems in an enterprise environment.
  • Hunt through and perform incident response across hundreds of unique systems simultaneously using PowerShell or F-Response Enterprise and the SIFT Workstation.
  • Identify and track malware beaconing outbound to its command and control (C2) channel via memory forensics, registry analysis, and network connection residue.
  • Determine how the breach occurred by identifying the root cause, the beachhead systems and initial attack mechanisms.
  • Identify living off the land techniques, including malicious use of PowerShell and WMI.
  • Target advanced adversary anti-forensics techniques like hidden and time-stomped malware, along with living off the land techniques used to move in the network and maintain an attacker's presence.
  • Use memory analysis, incident response, and threat hunting tools in the SIFT Workstation to detect hidden processes, malware, attacker command lines, rootkits, network connections, and more.
  • Track user and attacker activity second-by-second on the system you are analyzing through in-depth timeline and super-timeline analysis.
  • Recover data cleared using anti-forensics techniques via Volume Shadow Copy and Restore Point analysis.
  • Identify lateral movement and pivots within your enterprise across your endpoints, showing how attackers transition from system to system without detection.
  • Understand how the attacker can acquire legitimate credentials - including domain administrator rights - even in a locked-down environment.
  • Track data movement as attackers collect critical data and shift it to exfiltration collection points.
  • Recover data cleared using anti-forensics techniques via Volume Shadow Copy and Restore Point analysis and artifact carving.
  • Use collected data to perform effective remediation across the entire enterprise.
What You Will Receive
  • SIFT Workstation
    • This course extensively uses the SIFT Workstation to teach incident responders and forensic analysts how to respond to and investigate sophisticated attacks.
    • The SIFT Workstation contains hundreds of free and open-source tools, easily matching any modern forensic and incident response commercial response tool suite.
    • A virtual machine is used with many of the hands-on class exercises.
    • Ubuntu Linux LTS Base.
    • 64-bit base system.
    • Better memory utilization.
    • Auto-DFIR package update and customizations.
    • Latest forensics tools and techniques.
    • VMware Appliance ready to tackle forensics
    • Docker and ELK pre-installed
    • Cross-compatibility between Linux and Windows.
    • Expanded file system support (NTFS, HFS, EXFAT, and more).
  • F-Response Enterprise (Endpoint Collection Capability)
    • Enables incident responders to access remote systems and physical memory of a remote computer via the network.
    • Gives any incident response or forensics tool the capability to be used across the enterprise.
    • Perfect for intrusion investigations and data breach incident response situations.
    • Deployable agent to remote systems.
    • SIFT Workstation compatible.
    • Vendor neutral - works with just about any tool.
    • Number of simultaneous examiners = unlimited.
    • Number of simultaneous agents deployed = unlimited.
    • The six-month license allows F-Response Enterprise to continue to be used and benchmarked in your environment at work/home.
  • Electronic Download Package containing:
    • APT case images, memory captures, SIFT Workstation virtual machines, tools, and documentation.
    • SANS DFIR APT Case Electronic Exercise Workbook
    • Exercise workbook is over 500 pages long with detailed step-by-step instructions and examples to help you master incident response
  • SANS DFIR Cheat Sheets to Help Use the Tools in the Field

Enquire

Start date Location / delivery
01 May 2023 Virtual Book now

Related article

At GIAC, we believe that hands-on testing is the future of cybersecurity certification. With five certification exams featuring CyberLive , and thr...