Course Slide Deck & Practice Labs

• Detection Engineering Professional - Attack Simulation & Defense.pdf

• Attack Simulation and Detection Engineering Practice Labs.pdf

• Process Injection Tool - TrainSec Injector.zip

1: Welcome & Intro

• 1 - Welcome

• 2 - About Uriel Kosayev

• 3 - What to Expect from this Course

• 4 - The Art and Essence of Detection Engineering

• 5 - The Essence of this Course

2: Attack & Defense Mindset

• 1 - Introduction

• 2 - Who is a Hacker

• 3 - Basic Concepts - Part 1

• 4 - Basic Concepts - Part 2

• 5 - The CIA Triad

• 6 - The DAD Triad

• 7 - The Cyber Kill-Chain - Part 1

• 8 - The Cyber Kill-Chain - Part 2

• 9 - Threat Actor Types

• 10 - Infamous Cyber Attacks

• 11 - Attacker's Goals & Desires

• 12 - How attackers hide their traces

• 13 - The Darknet

3: Attacker's Martial Art

• 1 - Reconnaissance

• 2 - Google Hacking & Dorks

• 3 - Port Mapping with Nmap

• 4 - AV-EDR Bypass - Part 1

• 5 - AV-EDR Bypass - Part 2

• 6 - Social Engineering Phishing Web Page

• 7 - SSL Stripping - Part 13

• 8 - SSL Stripping - Part 2

• 9 - Infrastructure Exploitation

• 10 - Post Exploitation - Part 1

• 11 - Post Exploitation - Part 2

• 12 - Remote Brute Force

4: Introduction to Malware Attacks

• 1 - Intro

• 2 - Types of Malware

• 3 - Malware Analysis

• 4 - The ATT&CK MITRE Framework

• 5 - Atomic Red Team

• 6 - The Emotet Usecase - Part 1

• 7 - The Emotet Usecase - Part 2

5: Proactive Defense - Cybersecurity Hardening

• 1 - Intro

• 2 - Basic Concepts

• 3 - The Principle of Least Privilege - Part 13

• 4 - The Principle of Least Privilege - Part 2

• 5 - General Security Best Practices

• 6 - VLAN Hopping

• 7 - More Attack Techniques

• 8 - Network Attacks Mitigation Practices

• 9 - DDoS Attacks & Mitigations

• 10 - Brute Force & Physical Access Attacks

• 11 - DNS Zone Transfer Attack & Mitigations

• 12 - Credential Dumping & Mitigations

• 13 - OS & Network Security

6: Proactive Defense - Threat Hunting & Incident Response

• 1 - IR Intro

• 2 - IR Intro - Part 2

• 3 - Preparation

• 4 - Identification & Analysis

• 5 - Identification & Analysis - Part 2

• 6 - Incident Containment

• 7 - Incident Containment - Part 2

• 8 - Incident Eradication & Recovery

• 9 - The Aftermath - What happens after the Incident

• 10 - Threat Hunting3

• 11 - Threat Hunting - Part 2

• 12 - Threat Hunting - Part 3

7: Working with Windows Event Logs

• 1 - Intro & Log Sources

• 2 - Exploring Windows Event Viewer

• 3 - Exploring Windows Event Viewer - Part 22

• 4 - Common Windows Event IDs

• 5 - Common Windows Event IDs - Part 2

• 6 - Analyzing Event ID 4625 Failed Logon

• 7 - Analyzing Event ID 4625 Failed Logon - Part 2

• 8 - Analyzing Event ID 4624 Successful Logon3

• 9 - Domain Discovery & Lack of Telemetry Data

• 10 - Domain Discovery & Lack of Telemetry Data - Part 2

8: Sysmon Detection Engineering

• 1 - Sysmon Intro

• 2 - Sysmon Intro - Part 2

• 3 - Core Sysmon Event IDs & Blind Spots

• 4 - Deploying Sysmon

• 5 - Detecting Nltest using ProcessCreate Event

• 6 - Detecting Nltest using ProcessCreate Event - Part 2

• 7 - Detecting the Net command using ProcessCreate Event2

• 8 - Detecting the Net command using ProcessCreate Event - Part 2

• 9 - Detecting DNS Queries

• 10 - Detecting DNS Queries - Part 22

• 11 - Detecting Persistence using the FileCreate event

• 12 - Detecting Persistence using the FileCreate event - Part 2

• 13 - Detecting Persistence using RegistryEvent

• 14 - Detecting Persistence using RegistryEvent - Part 2

• 15 - Detecting Credential Access using ImageLoad2

• 16 - Detecting Credential Access using ImageLoad - Part 2

• 17 - Sysmon Events Exclusion

• 18 - Detecting the CreateRemoteThread Process Injection

9: EDR - XDR Detection Fundamentals & Deployment

• 1 - Intro

• 2 - AV vs. EDR vs. XDR vs. SIEM

• 3 - Detection Kill-Chain & Process Tree

• 4 - Detection Correlation

• 5 - Incidents & Alerts Chain of Events

• 6 - Elastic Security EDR Overview

• 7 - Deploying Elastic Defend

• 8 - Deploying Elastic Defend - Part 2

• 9 - Optimizing the Security Policy and Enabling Anti-Tampering

• 10 - EDR Telemetry Collection Sanity Check

10: Attack and Defense - Initial Access and Lateral Movement

• 1 - Attack & Defense Intro

• 2 - RDP Attack Simulation

• 3 - RDP Attack Investigation

• 4 - RDP Attack Detection

• 5 - RDP Attack Detection - Part 2

• 6 - RDP Attack Detection - Part 3

• 7 - PSexec Attack Simulation

• 8 - PSexec Attack Investigation

• 9 - PSexec Attack Detection

• 10 - WinRM Attack Simulation

• 11 - WinRM Attack Investigation

• 12 - WinRM Attack Detection5

11: Attack and Defense - Discovery

• 1 - Nltest Discovery Simulation

• 2 - Nltest Discovery Investigation

• 3 - Nltest Discovery Detection

• 4 - Net Discovery Simulation

• 5 - Net Discovery Investigation

• 6 - Net Discovery Detection

12: Attack and Defense - Living-off-the-Land (LOLbin & Friends)

• 1 - The Emotet Usecase - Detecting PowerShell Attacks

• 2 - WMI Attack Simulation2

• 3 - WMI Attack Investigation

• 4 - WMI Attack Detection

• 5 - KeyMgr Detection Bypass Red Team Edition

• 6 - KeyMgr Detection Bypass Red Team Edition - Part,2

13: Attack and Defense - Persistence & Credential Access

• 1 - Registry Persistence Attack Simulation

• 2 - Registry Persistence Attack Investigation

• 3 - Registry Persistence Attack Detection

• 4 - Service Persistence Attack Simulation

• 5 - Service Persistence Attack Investigation

• 6 - Service Persistence Attack Detection

• 7 - Startup Folder Persistence Attack Simulation

• 8 - Startup Folder Persistence Attack Investigation

• 9 - Startup Folder Persistence Attack Detection

• 10 - Credential Access Techniques

14: Attack and Defense - AI & Process Injection

• Process Injection Tool - TrainSec Injector.zip

• 1 - Process Injection Techniques Attack Simulation

• 2 - Process Injection Techniques Attack Investigation & Detection

• 3 - AI Assisted Detection Engineering

• 4 - AI Assisted Detection Engineering - Part 2

• 5 - AI Assisted Detection Engineering - Part 3

15: To know your enemy, you must become your enemy - Final Notes & Labs

• 1 - Pro Tips

• 2 - Attack Simulation and Detection Engineering Practice Labs

• 3 - Thank you

Bonus Content

• 1 - Interesting Windows Folder Paths

• 2 - Interesting Windows Folder Paths - Part 2

• 3 - Interesting Windows Registry Keys

• DEF CON 34 - The Silent Tunneler - A Real-World Incident Response Story