Advanced Incident Response, Threat Hunting, and Digital Forensics

Threat hunting and Incident response tactics and procedures have evolved rapidly over the past several years. Your team can no longer afford to use antiquated incident response and threat hunting techniques that fail to properly identify compromised systems. The key is to constantly look for attacks that get past security systems, and to catch intrusions in progress, rather than after attackers have completed their objectives and done worse damage to the organization. For the incident responder, this process is known as ” threat hunting “.  This Course teaches advanced skills to hunt, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hactivists.

(Online classes available)

Course Key Learnings

• Understand attacker tradecraft to perform compromise assessments
• Detect how and when a breach occurred
• Quickly identify compromised and infected systems
• Perform damage assessments and determine what was read, stolen, or changed
• Contain and remediate incidents of all types
• Track adversaries and develop threat intelligence to scope a network
• Hunt down additional breaches using knowledge of the adversary
• Build advanced forensics skills to counter anti-forensics and data hiding from technical subjects

Business Takeaways:

• Understand attacker tradecraft to perform proactive compromise assessments
• Upgrade detection capabilities via better understanding of novel attack techniques, focus on critical attack paths, and knowledge of available forensic artifacts
• Develop threat intelligence to track targeted adversaries and prepare for future intrusion events
• Build advanced forensics skills to counter anti-forensics and data hiding from technical subjects for use in both internal and external investigations

Course Content

Module1: Advanced Incident Response & Threat Hunting

This course was designed to help organizations increase their capability to detect and respond to intrusion events. This is an achievable goal and begins by teaching the tools and techniques necessary to find evil in your network. This course is designed to make you and your organization an integral part of the solution. To keep pace, incident responders and threat hunters must be armed with the latest tools, analysis techniques, and enterprise methodologies to identify, track, and contain advanced adversaries with the ultimate goal of rapid remediation of incidents and damage mitigation. Further, incident response and threat hunting analysts must be able to scale their efforts across potentially thousands of systems in the enterprise. We start the day by examining the six-step incident response methodology as it applies to incident response for advanced threat groups. The importance of developing cyber threat intelligence to impact the adversaries’ “kill chain” is discussed and forensic live response techniques and tactics are demonstrated that can be applied both to single systems and across the entire enterprise.

Exercises

• Forensic Lab Setup and Orientation Using the SIFT Workstation
• Malware Persistence Detection and Analysis
• Scaling Data Collection and Analysis Across the Enterprises
• Finding and Analyzing Malicious WMI attacks

Topics

Real Incident Response Tactics

• Preparation: Key tools, techniques, and procedures that an incident response team needs to respond properly to intrusions
• Identification/Scoping: Proper scoping of an incident and detecting all compromised systems in the enterprise
• Containment/Intelligence Development: Restricting access, monitoring, and learning about the adversary in order to develop threat intelligence
• Eradication/Remediation: Determining and executing key steps that must be taken to help stop the current incident and the move to real-time remediation
• Recovery: Recording of the threat intelligence to be used in the event of a similar adversary returning to the enterprise
• Avoiding “Whack-A-Mole” Incident Response: Going beyond immediate eradication without proper incident scoping/containment

Threat Hunting

• Hunting versus Reactive Response
• Intelligence-Driven Incident Response
• Building a Continuous Incident Response/Threat Hunting Capability
• Forensic Analysis versus Threat Hunting Across Endpoints
• Threat Hunt Team Roles
• ATT&CK – MITRE’s Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK(TM))

Threat Hunting in the Enterprise

• Identification of Compromised Systems
• Finding Active and Dormant Malware
• Digitally Signed Malware
• Malware Characteristics
• Common Hiding and Persistence Mechanisms

• Finding Evil by Understanding Normal

Incident Response and Hunting across Endpoints

• WMIC & PowerShell
• PowerShell Remoting Scalability
• PowerShell Remoting Credential Safeguards
• Kansa PowerShell Remoting IR Framework

Malware Defense Evasion and Identification

• Service Hijacking/Replacement
• Frequent Compilation
• Binary Padding
• Packing/Armoring
• Dormant Malware
• Signing Code with Valid Certificates
• Anti-Forensics/Timestomping
• Living of the Land Binaries and Security Tool Evasion

Malware Persistence Identification

• AutoStart Locations, RunKeys
• Service Creation/Replacement
• Service Failure Recovery
• Scheduled Tasks
• DLL Hijacking Attacks
• WMI Event Consumers

Prevention, detection, and mitigation of Credential Theft

• Pass the Hash
• Credential Attacks with Mimikatz
• Token Stealing
• Cached Credentials
• LSA Secrets
• Kerberos Attacks
• Golden Tickets
• Kerberoasting
• DCSync
• NTDS.DIT theft
• Bloodhound and Active Directory Graphing
• Common dumping tools including Metasploit, Acehash, Windows Credential Editor, and many others.

Module.2: Intrusion Analysis

Overview

Even the most advanced adversaries leave footprints everywhere. Learn the secrets of the best hunters.

Cyber defenders have a wide variety of tools and artifacts available to identify, hunt, and track adversary activity in a network. Each attacker action leaves a corresponding artifact, and understanding what is left behind as footprints can be crucial to both red and blue team members. Attacks follow a predictable pattern, and we focus our detective efforts on immutable portions of that pattern. As an example, at some point an attacker will need to run code to accomplish their objectives. We can identify this activity via application execution artifacts. The attacker will also need one or more accounts to run code. Consequently, account auditing is a powerful means of identifying malicious. An attacker also needs a means to move throughout the network, so we look for artifacts left by the relatively small number of ways there are to accomplish internal lateral movement. In this section, we cover common attacker tradecraft and discuss the various data sources and forensic tools you can use to identify malicious activity in the enterprise.

Get ready to hunt!

Exercises

• Hunting and Detecting Evidence of Execution at Scale with Prefetch, Shimcache and Amcache
• Discovering Credential abuse with Event Log Collection and Analysis
• Tracking Lateral Movement with Event Log Analysis
• Hunting Malicious use of WMI and PowerShell

Topics

Stealing and Utilization of Legitimate Credentials

• Pass the Hash
• Single Sign On (SSO) Dumping using Mimikatz
• Token Stealing
• Cached Credentials
• LSA Secrets
• Kerberos Attacks
• NTDS.DIT theft

Advanced Evidence of Execution Detection

• Attacker Tactics, Techniques, and Procedures (TTPs) Observed Via Process Execution
• Prefetch Analysis
• Application Compatibility Cache (ShimCache)
• Amcache Registry Examination
• Scaling ShimCache and Amcache Investigations

Lateral Movement Adversary Tactics, Techniques, and Procedures (TTPs)

• Compromising Credentials Techniques
• Remote Desktop Services Misuse
• Windows Admin Share Abuse
• PsExec and Cobalt Strike Beacon PsExec Activity
• Windows Remote Management Tool Techniques
• PowerShell Remoting/WMIC Hacking
• Cobalt Strike Lateral Movement and Credential Use
• Vulnerability Exploitation

Log Analysis for Incident Responders and Hunters

• Profiling Account Usage and Logons
• Tracking and Hunting Lateral Movement
• Identifying Suspicious Services
• Detecting Rogue Application Installation
• Finding Malware Execution and Process Tracking
• Capturing Command Lines and Scripts
• Anti-Forensics and Event Log Clearing

Investigating WMI and PowerShell-Based Attacks

• WMI Overview
• WMI Attacks Across the Kill Chain
• Auditing the WMI Repository
• WMI File System and Registry Residue
• Command-Line Analysis and WMI Activity Logging
• PowerShell Transcript and ScriptBlock Logging
• Discovering Cobalt Strike beacon PowerShell Import Activity
• Detecting PowerShell Injection from Cobalt Strike, Metasploit, and Empire
• PowerShell Script Obfuscation

Module3: Memory Forensics in Incident Response & Threat Hunting

Overview

Using memory analysis sometimes feels like cheating — finding active attacks shouldn’t be this easy.

Memory forensics has come a long way in just a few years. It is now a critical component of many advanced tool suites (notably EDR) and the mainstay of successful incident response and threat hunting teams. Memory forensics can be extraordinarily effective at finding evidence of worms, rootkits, PowerShell attacks, ransomware precursors, and advanced malware used by targeted attackers. In fact, some fileless attacks may be nearly impossible to unravel without memory analysis. Memory analysis was traditionally the domain of Windows internals experts and reverse engineers, but new tools, techniques, and detection heuristics have greatly leveled the playing field making it accessible today to all investigators, incident responders, and threat hunters. Further, understanding attack patterns in memory is a core analyst skill applicable across a wide range of endpoint detection and response (EDR) products, making those tools even more effective. This extremely popular section will cover many of the most powerful memory analysis capabilities available and give analysts a solid foundation of advanced memory forensic skills to super-charge investigations, regardless of the toolset employed.

Exercises

• Scaling remote endpoint incident response, hunting, and analysis using Velociraptor
• Remote endpoint triage and memory examination using F-Response Enterprise
• Creating local and remote triage evidentiary images with KAPE
• Detect unknown live and dormant custom malware in memory across multiple systems in an enterprise environment
• Examine Windows process trees to identify normal versus anomalies
• Find advanced “beacon” malware over common ports used by targeted attackers to access command and control (C2) channels
• Find residual attacker command-line activity through scanning strings in memory and by extracting command history buffers
• Compare compromised system memory against a baseline system using Frequency of Least Occurrence stacking techniques
• Identify advanced malware hiding techniques, including code injection and rootkits
• Employ indicators of compromise to automate analysis
• Analysis of memory from infected systems:

• • Stuxnet
  • TDL3/ TDSS
  • CozyDuke APT29 RAT
  • Rundll32 and Living Off the Land Executions
  • Zeus/Zbot/Zloader
  • Emotet
  • SolarMarker
  • Black Energy Rootkit
  • WMI and PowerShell
  • Cobalt Strike Beacons and Powerpick
  • Cobalt Strike Sacrificial Processes
  • Metasploit
  • Custom APT command and control malware

Topics

• Remote and Enterprise Incident Response

• • Remote Endpoint Access in the Enterprise
  • Remote Endpoint Host-based Analysis
  • Scalable Host-based Analysis (one analyst examining 1,000 systems) and Data Stacking
  • Remote Memory Analysis
  • Velociraptor, F-Response, and KAPE

• Triage and Endpoint Detection and Response (EDR)

• • Endpoint Triage Collection
  • EDR Capabilities and Challenges
  • EDR and Memory Forensics

• Memory Acquisition

• • Acquisition of System Memory
  • Hibernation and Pagefile Memory Extraction and Conversion
  • Virtual Machine Memory Acquisition
  • Memory changes in Windows 10 and 11

• Memory Forensics Analysis Process for Response and Hunting

• • Understanding Common Windows Services and Processes
  • Identify Rogue Processes
  • Analyze Process Objects
  • Review Network Artifacts
  • Look for Evidence of Code Injection
  • Audit Drivers and Rootkit Detection
  • Dump Suspicious Processes and Drivers

• Memory Forensics Examinations

• • Live Memory Forensics
  • Memory Analysis with Volatility
  • Webshell Detection Via Process Tree Analysis
  • Code Injection, Malware, and Rootkit Hunting in Memory
  • Advanced Memory Forensics with MemProcFS
  • WMI and PowerShell Process Anomalies
  • Extract Memory-Resident Adversary Command Lines
  • Investigate Windows Services
  • Hunting Malware Using Comparison Baseline Systems
  • Find and Dump Cached Files from RAM

• Memory Analysis Tools

• • F-Response
  • Velociraptor
  • Volatility
  • MemProcFS

Module4: Timeline Analysis

Overview

Timeline analysis will change the way you approach digital forensics, threat hunting, and incident response…forever.

Learn advanced incident response and hunting techniques uncovered via timeline analysis directly from the authors who pioneered timeline analysis tradecraft. Temporal data is located everywhere on a computer system. Filesystem modified/access/creation/change times, log files, network data, registry data, and browser history files all contain time data that can be correlated and analyzed to rapidly solve cases. Pioneered by Rob Lee as early as 2001, timeline analysis has grown to become a critical incident response, hunting, and forensics technique. New timeline analysis frameworks provide the means to conduct simultaneous examinations on a multitude of systems across a multitude of forensic artifacts. Analysis that once took days now takes minutes.

This section will step you through two primary methods of building and analyzing timelines used during advanced incident response, threat hunting, and forensic cases. Exercises will show analysts how to create timelines and how to introduce the key analysis methods necessary to help you use those timelines effectively in your cases.

Exercises

• Detecting malware defense evasion techniques
• Using timeline analysis, track adversary activity by hunting an APT group’s footprints of malware, lateral movement, and persistence
• Target hidden and time-stomped malware and utilities that advanced adversaries use to move in the network and maintain their presence
• Track advanced adversaries’ actions second-by-second through in-depth super-timeline analysis
• Observe how attackers laterally move to other systems in the enterprise by watching a trail left in filesystem times, registry, event logs, shimcache, and other temporal-based artifacts
• Identify root cause of an intrusion
• Learn how to filter system artifact, file system, and registry timelines to target the most important data sources efficiently

Topics

Malware Defense Evasion and Detection

• Indicators of Compromise – YARA
• Entropy and Packing Analysis
• Executable Anomaly Detection
• Digital Signature Analysis

Timeline Analysis Overview

• Timeline Benefits
• Prerequisite Knowledge
• Finding the Pivot Point
• Timeline Context Clues
• Timeline Analysis Process

Filesystem Timeline Creation and Analysis

• MACB Timestamps
• Windows Time Rules (File Copy versus File Move)
• Filesystem Timeline Creation Using Sleuthkit, fls and MFTECmd
• Bodyfile Analysis and Filtering Using the mactime Tool

Super Timeline Creation and Analysis

• Super Timeline Artifact Rules
• Program Execution, File Knowledge, File Opening, File Deletion
• Timeline Creation with log2timeline/Plaso
• log2timeline/ Plaso Components
• Filtering the Super Timeline Using psort
• Targeted Super Timeline Creation
• Super Timeline Analysis Techniques
• Scaling Super Timeline Analysis with Elastic Search (ELK)

Module5: : Incident Response & Hunting Across the Enterprise | Advanced Adversary & Anti-Forensics Detection

• Overview

  Attackers commonly take steps to hide their presence on compromised systems. While some anti-forensics steps can be relatively easy to detect, others are much harder to deal with. As such, it’s important that forensic professionals and incident responders are knowledgeable on various aspects of the operating system and file system which can reveal critical residual evidence. Criminal and ransomware syndicates have become particularly aggressive in their use of anti-forensic techniques. In this section, we focus on recovering files, file fragments, and file metadata of interest to the investigation. These trace artifacts can help the analyst uncover deleted logs, attacker tools, malware configuration information, exfiltrated data, and more. This often results in a deeper understanding of the attacker TTPs and provides more threat intelligence for rapid scoping of an intrusion and mitigating damage. In some cases, these deep-dive techniques could be the only means for proving that an attacker was active on a system of interest and ultimately determining root cause. While very germane to intrusion cases, these techniques are applicable in nearly every forensic investigation.

  Exercises

  • Volume shadow snapshot analysis
  • Timelines incorporating volume shadow snapshot data
  • Anti-Forensics analysis using NTFS filesystem components
  • Timestomp identification and suspicious file detections
  • Advanced data recovery with records carving and deleted volume shadow copy recovery

  Topics

  Volume Shadow Copy Analysis

  • Volume Shadow Copy Service
  • Options for Accessing Historical Data in Volume Snapshots
  • Accessing Shadow Copies with vshadowmount
  • Volume Shadow Copy Timelining

  Advanced NTFS Filesystem Tactics

  • NTFS Filesystem Analysis
  • Master File Table (MFT) Critical Areas
  • NTFS System Files
  • NTFS Metadata Attributes
  • Rules of Windows Timestamps for $StdInfo and $Filename
  • Detecting Timestamp Manipulation
  • Resident versus Nonresident Files
  • Alternate Data Streams
  • NTFS Directory Attributes
  • B-Tree Index Overview and Balancing
  • Finding Wiped/Deleted Files using the $I30 indexes
  • Filesystem Flight Recorders: $Logfile and $UsnJrnl
  • Common Activity Patterns in the Journals
  • Useful Filters and Searches in the Journals
  • What Happens When Data Is Deleted from an NTFS Filesystem?

  Advanced Evidence Recovery

  • Markers of Common Wipers and Privacy Cleaners
  • Deleted Registry Keys
  • Detecting “Fileless” Malware in the Registry
  • File Carving
  • Volume Shadow Carving
  • Carving for NTFS artifacts and Event Log Records
  • Effective String Searching
  • NTFS Configuration Changes to Combat Anti-Forensic

Module6:

Overview

This incredibly rich and realistic enterprise intrusion exercise is based on a real-world advanced persistent threat (APT) group. It brings together techniques learned earlier in the course and tests your newly acquired skills in an investigation into an attack by an advanced adversary. The challenge brings it all together using a real intrusion into a complete Windows enterprise environment. You will be asked to uncover how the systems were compromised in the initial intrusion, find other compromised systems via adversary lateral movement, and identify intellectual property stolen via data exfiltration. You will walk out of the course with hands-on experience investigating a real attack, curated by a cadre of instructors with decades of experience fighting advanced threats from attackers ranging from nation-states to financial crime syndicates and hacktivist groups.

Topics

• The Intrusion Forensic Challenge will ask each incident response team to analyze multiple systems in an enterprise network with many endpoints.
• Learn to identify and track attacker actions across an entire network finding initial exploitation, reconnaissance, persistence, credential dumping, lateral movement, elevation to domain administrator, and data theft/exfiltration
• Witness and participate in a team-based approach to incident response.
• Discover evidence of some of the most common and sophisticated attacks in the wild including Cobalt Strike, Metasploit, PowerShell exploit frameworks, and custom nation-state malware.
• During the challenge, each incident response team will be asked to answer key questions and address critical issues in the different categories listed below, just as they would during a real breach in their organizations:

IDENTIFICATION AND SCOPING:

1. How and when was the network breached?

2. List all compromised systems by IP address and specific evidence of compromise.

3. When and how did the attackers first laterally move to each system?

CONTAINMENT AND THREAT INTELLIGENCE GATHERING:

4. How and when did the attackers obtain domain administrator credentials?

5. Once on other systems, what did the attackers look for on each system?

6. Find exfiltrated email from executive accounts and perform damage assessment.

7. Determine what was stolen: Recover any attacker archives, find encryption passwords, and extract the contents to verify exfiltrated data.

8. Collect and list all malware used in the attack.

9. Develop and present cyber threat intelligence based on host and network indicators of compromise.

REMEDIATION AND RECOVERY:

10. What level of account compromise occurred. Is a full password reset required during remediation?

11. Based on the attacker techniques and tools discovered during the incident, what are the recommended steps to remediate and recover from this incident?

a. What systems need to be rebuilt?

b. What IP addresses need to be blocked?

c. What countermeasures should we deploy to slow or stop these attackers if they come back?

d. What recommendations would you make to detect these intruders in our network again?

International Student Fee: 950$

Job Interview Preparation  (Soft Skills Questions & Answers)

• Tough Open-Ended Job Interview Questions
• What to Wear for Best Job Interview Attire
• Job Interview Question- What are You Passionate About?
• How to Prepare for a Job Promotion Interview

 Your FREE eLEARNING Courses (Click Here)

Internships, Freelance and Full-Time Work opportunities

• Join Internships and Referral Program (click for details)
• Work as Freelancer or Full-Time Employee (click for details)

Flexible Class Options

• Week End Classes For Professionals  SAT | SUN
• Corporate Group Trainings Available
• Online Classes – Live Virtual Class (L.V.C), Online Training

Related Courses

Windows Forensic Analysis