Modern Threat Hunting Strategies to Identify Attacks

Course details

Fortify your organization's defenses against sophisticated cyber threats by learning how to implement methods and techniques that can prevent, identify, and mitigate attacks. Examine the critical areas of permissions, privileges, and network tracing to enhance the protection against cyberattacks. Discover a checklist of steps to take that strengthen security hygiene. Learn about static and dynamic malware analysis. Review practical case studies of misconfigured service accounts and Kerberoasting attacks.

The course also covers methods for uncovering lateral movements and network communications that criminals use to navigate through and harm networks. Learn about important techniques for extracting and reviewing logs and traces from disks and memory, for comprehensive monitoring and responding quickly to potential threats. Join instructor Paula Januszkiewicz who equips you to be able to implement robust security measures and contribute to the overall system integrity of your organization.

Concepts

0. Introduction

01 - Threat hunting in the modern world

1. Permissions and Privileges - Impact on Attack Success

02 - Permissions and deflecting cyberattacks
03 - Privileges and deflecting cyberattacks
04 - Security hygiene checklist - Permissions and privileges

2. Modern Threat Hunting Practices

05 - Detecting unnecessary services
06 - Reviewing places with persistence
07 - Case Study - Misconfigured service account
08 - Steps for static malware analysis
09 - Steps for dynamic malware analysis
10 - Uncovering lateral movement

3. Uncovering Network Communication

11 - Network tracing in threat hunting
12 - Tools for network tracing
13 - Types of vulnerabilities found in network tracing
14 - Proactive security - Network tracing and system processes
15 - Security hygiene checklist - Network tracing

4. Data, Extracting Traces, and Logs

16 - Data correlation techniques
17 - Case study - Kerberoasting Attack
18 - Extracting traces of attacks from the disk
19 - Extracting traces of attacks from the memory
20 - Reviewing logs for useful events
21 - Case study - Practical attack scenario

Conclusion

22 - Next steps