FOR572: Cyber Security Training at Tokyo January 2025

What You Will Learn

Take your system-based forensic knowledge onto the network. Incorporate network evidence into your investigations, provide better findings, and get the job done faster.

It is exceedingly rare to work any forensic investigation that doesn't have a network component. Endpoint forensics will always be a critical and foundational skill for DFIR professionals but overlooking their network communications is like ignoring security camera footage of a crime as it was committed. Whether you handle an intrusion incident, data theft case, employee misuse scenario, or are engaged in proactive adversary discovery, the network often provides an unparalleled view of the incident. Its evidence can provide the proof necessary to show intent, uncover attackers that have been active for months or longer, or may even prove useful in definitively proving a crime actually occurred.

FOR572: ADVANCED NETWORK FORENSICS: THREAT HUNTING, ANALYSIS AND INCIDENT RESPONSE was designed to cover the most critical skills needed for the increased focus on network communications and artifacts in today's investigative work, including numerous use cases. Many investigative teams are incorporating proactive threat hunting to their skills in which existing evidence is used with newly acquired threat intelligence to uncover evidence of previously unidentified incidents. Others focus on post-incident investigations and reporting. Still others engage with an adversary in real time, seeking to contain and eradicate the attacker from the victim's environment. In these situations and more, the artifacts left behind from attackers' communications can provide an invaluable view into their intent, capabilities, successes, and failures.

In FOR572, we focus on the knowledge necessary to examine and characterize communications that have occurred in the past or continue to occur. Even if the most skilled remote attacker has compromised a system with an undetectable exploit, the system must still communicate over the network. Without command-and-control and data extraction channels, the value of a compromised computer system drops to almost zero. Put another way: bad actors are talking - we'll teach you to listen.

This course covers the investigative tools, techniques, and procedures required to integrate network evidence sources into your investigations, with a focus on efficiency and effectiveness. You will leave this week with a well-stocked toolbox and the knowledge to use it on your first day back on the job. We will cover the full spectrum of network evidence, including high level NetFlow analysis, low-level pcap-based dissection, ancillary network log examination, and more. We cover how to leverage existing infrastructure devices that may contain months or years of valuable evidence as well as how to place new collection platforms while an incident is underway.

Whether you are a consultant responding to a client's site, a law enforcement professional assisting cybercrime victims and seeking prosecution of those responsible, an on-staff forensic practitioner, or a dedicated threat hunter, this course offers hands-on experience with real-world scenarios that will help take your work to the next level. Network defenders will benefit from the FOR572 perspective on security operations as they take on more incident response and investigative responsibilities. Those with existing endpoint-based DFIR experience can take their existing operating system or device knowledge and apply it directly to the network-based attacks that occur daily. In FOR572, we solve the same caliber of real-world problems without the use of disk or memory images.

Most of FOR572's hands-on labs have been developed in conjunction with the authors of FOR508, Advanced Incident Response, Threat Hunting, and Digital Forensics. In these shared scenarios, you'll quickly see why a hybrid approach to forensic examination that includes both host and network artifacts is ideal. Although our primary focus is on the network side of that equation, we will point out areas where the host perspective could provide additional context or where the network perspective gives deeper insight. Both former and future FOR508 students will appreciate the nexus between these extensive evidence sets.

The hands-on labs in this class cover a wide range of tools and platforms, including the venerable tcpdump and Wireshark for packet capture and analysis; NetworkMiner for artifact extraction; and open-source tools including nfdump, tcpxtract, tcpflow, and more. Newly added tools in the course include the free and open-source SOF-ELK® platform - a VMware appliance pre-configured with the Elastic stack and tailored to DFIR and security operations workflows. This "big data" platform includes the Elasticsearch storage and search database, the Logstash ingest and parsing engine, and the Kibana graphical dashboard interface. Together with the custom SOF-ELK® configuration files, the platform gives forensicators a ready-to-use platform for log and NetFlow analysis. For full-packet analysis and hunting at scale, the free and open-source Arkime platform is also covered and used in a hands-on lab. Through all the in-class labs, shell scripting skills are highlighted as quick and easy ways to rip through hundreds of thousands or even millions of data records.

FOR572 is an advanced course - we hit the ground running on day one. Bring your entire bag of skills: forensic techniques and methodologies, full-stack networking knowledge (from the physical medium all the way up to user-facing services), Linux shell utilities, and everything in between. They will all benefit you throughout the course material as you FIGHT CRIME. UNRAVEL INCIDENTS...ONE BYTE (OR PACKET) AT A TIME.
You Will Be Able To

• Extract files from network packet captures and proxy cache files, allowing follow-on malware analysis or definitive data loss determinations
• Use historical NetFlow data to identify relevant past network occurrences, allowing accurate incident scoping
• Reverse engineer custom network protocols to identify an attacker's command-and-control abilities and actions
• Decrypt captured SSL/TLS traffic to identify attackers' actions and what data they extracted from the victim
• Use data from typical network protocols to increase the fidelity of the investigation's findings
• Identify opportunities to collect additional evidence based on the existing systems and platforms within a network architecture
• Examine traffic using common network protocols to identify patterns of activity or specific actions that warrant further investigation
• Incorporate log data into a comprehensive analytic process, filling knowledge gaps that may be far in the past
• Learn how attackers leverage meddler-in-the-middle tools to intercept seemingly secure communications
• Examine proprietary network protocols to determine what actions occurred on the endpoint systems
• Analyze wireless network traffic to find evidence of malicious activity
• Use scripting techniques to scale analysis to an arbitrarily large collection of evidence
• Apply the knowledge you acquire during the week in a full-day capstone lab, modeled after real-world nation-state intrusions and threat actors

Course Topics

• Packet capture applications and data
  • Unique considerations for network-focused forensic processes
  • Network evidence types and sources
  • Network architectural challenges and opportunities for investigators
  • Investigation OPSEC and footprint considerations
• Network protocol analysis
  • Hypertext Transfer Protocol (HTTP)
  • Domain Name Service (DNS)
  • File Transfer Protocol (FTP)
  • Server Message Block (SMB) and related Microsoft protocols
  • Simple Mail Transfer Protocol (SMTP)
• Commercial network forensic tools
• Automated tools and libraries
• NetFlow
  • Introduction
  • Collection approaches
  • Open-source NetFlow tools

• Wireless networking
  • Capturing wireless traffic
  • Useful forensic artifacts from wireless traffic
  • Common attack methods and detection
• Log data to supplement network examinations
  • Syslog
  • Microsoft Windows Event Forwarding
  • HTTP server logs
  • Network Security Monitoring (NSM) platforms
  • Log collection, aggregation, and analysis
  • Web proxy server examination
• Encryption
  • Transport Layer Security (TLS)
  • Profiling TLS clients without interception
  • Meddler-in-the-middle and TLS interception
• Deep packet work
  • Network protocol reverse engineering
  • Payload reconstruction

Business Takeaways

• Round out your team's investigations to include network perspectives inherent in all environments
• Build baselines that can be used to proactively identify malicious activity early in a compromise, before large-scale damage is done
• Provide additional value for existing network data collections that support existing operational requirements
• Ensure critical observations from the network are not overlooked in proactive hunting or post-compromise IR actions

"I feel like the last week has been a massive eye-opener into what extra information I can now use in my forensic investigations." - Will B.
What You Will Receive

Custom distribution of the Linux SANS SIFT Workstation Virtual Machine with over 500 digital forensics and incident response tools prebuilt into the environment, including network forensic tools added just for this course

• SOF-ELK® Virtual Machine - a custom distribution of the publicly available appliance running the ELK stack and the course author's custom set of configurations and dashboards. The VM is preconfigured to ingest syslog logs, HTTPD logs, and NetFlow, and will be used during the class to help students wade through the hundreds of millions of records they are likely to encounter during a typical investigation
• Arkime Virtual Machine - a standalone VM running the free Arkime platform. Arkime ingests and indexes live network data or pcap files, providing a platform that makes full-packet analysis attainable
• Realistic case data to examine during class, from multiple sources including:
  • NetFlow data
  • Web proxy, firewall, and intrusion detection system logs
  • Network captures in pcap format
  • Network service logs
• Electronic downloadable package loaded with case examples, tools, and documentation