6 - KeyMgr Detection Bypass Red Team Edition - Part,2
Preview unavailable
You must log in or sign up to view this lesson.
Login
Sign up
Detection Engineering Professional: Attack Simulation & Defense
Buy now
Learn more
Course Slide Deck & Practice Labs
Detection Engineering Professional - Attack Simulation & Defense.pdf
Attack Simulation and Detection Engineering Practice Labs.pdf
Process Injection Tool - TrainSec Injector.zip
1: Welcome & Intro
1 - Welcome
2 - About Uriel Kosayev
3 - What to Expect from this Course
4 - The Art and Essence of Detection Engineering
5 - The Essence of this Course
2: Attack & Defense Mindset
1 - Introduction
2 - Who is a Hacker
3 - Basic Concepts - Part 1
4 - Basic Concepts - Part 2
5 - The CIA Triad
6 - The DAD Triad
7 - The Cyber Kill-Chain - Part 1
8 - The Cyber Kill-Chain - Part 2
9 - Threat Actor Types
10 - Infamous Cyber Attacks
11 - Attacker's Goals & Desires
12 - How attackers hide their traces
13 - The Darknet
3: Attacker's Martial Art
1 - Reconnaissance
2 - Google Hacking & Dorks
3 - Port Mapping with Nmap
4 - AV-EDR Bypass - Part 1
5 - AV-EDR Bypass - Part 2
6 - Social Engineering Phishing Web Page
7 - SSL Stripping - Part 1
3
8 - SSL Stripping - Part 2
9 - Infrastructure Exploitation
10 - Post Exploitation - Part 1
11 - Post Exploitation - Part 2
12 - Remote Brute Force
4: Introduction to Malware Attacks
1 - Intro
2 - Types of Malware
3 - Malware Analysis
4 - The ATT&CK MITRE Framework
5 - Atomic Red Team
6 - The Emotet Usecase - Part 1
7 - The Emotet Usecase - Part 2
5: Proactive Defense - Cybersecurity Hardening
1 - Intro
2 - Basic Concepts
3 - The Principle of Least Privilege - Part 1
3
4 - The Principle of Least Privilege - Part 2
5 - General Security Best Practices
6 - VLAN Hopping
7 - More Attack Techniques
8 - Network Attacks Mitigation Practices
9 - DDoS Attacks & Mitigations
10 - Brute Force & Physical Access Attacks
11 - DNS Zone Transfer Attack & Mitigations
12 - Credential Dumping & Mitigations
13 - OS & Network Security
6: Proactive Defense - Threat Hunting & Incident Response
1 - IR Intro
2 - IR Intro - Part 2
3 - Preparation
4 - Identification & Analysis
5 - Identification & Analysis - Part 2
6 - Incident Containment
7 - Incident Containment - Part 2
8 - Incident Eradication & Recovery
9 - The Aftermath - What happens after the Incident
10 - Threat Hunting
3
11 - Threat Hunting - Part 2
12 - Threat Hunting - Part 3
7: Working with Windows Event Logs
1 - Intro & Log Sources
2 - Exploring Windows Event Viewer
3 - Exploring Windows Event Viewer - Part 2
2
4 - Common Windows Event IDs
5 - Common Windows Event IDs - Part 2
6 - Analyzing Event ID 4625 Failed Logon
7 - Analyzing Event ID 4625 Failed Logon - Part 2
8 - Analyzing Event ID 4624 Successful Logon
3
9 - Domain Discovery & Lack of Telemetry Data
10 - Domain Discovery & Lack of Telemetry Data - Part 2
8: Sysmon Detection Engineering
1 - Sysmon Intro
2 - Sysmon Intro - Part 2
3 - Core Sysmon Event IDs & Blind Spots
4 - Deploying Sysmon
5 - Detecting Nltest using ProcessCreate Event
6 - Detecting Nltest using ProcessCreate Event - Part 2
7 - Detecting the Net command using ProcessCreate Event
2
8 - Detecting the Net command using ProcessCreate Event - Part 2
9 - Detecting DNS Queries
10 - Detecting DNS Queries - Part 2
2
11 - Detecting Persistence using the FileCreate event
12 - Detecting Persistence using the FileCreate event - Part 2
13 - Detecting Persistence using RegistryEvent
14 - Detecting Persistence using RegistryEvent - Part 2
15 - Detecting Credential Access using ImageLoad
2
16 - Detecting Credential Access using ImageLoad - Part 2
17 - Sysmon Events Exclusion
18 - Detecting the CreateRemoteThread Process Injection
9: EDR - XDR Detection Fundamentals & Deployment
1 - Intro
2 - AV vs. EDR vs. XDR vs. SIEM
3 - Detection Kill-Chain & Process Tree
4 - Detection Correlation
5 - Incidents & Alerts Chain of Events
6 - Elastic Security EDR Overview
7 - Deploying Elastic Defend
8 - Deploying Elastic Defend - Part 2
9 - Optimizing the Security Policy and Enabling Anti-Tampering
10 - EDR Telemetry Collection Sanity Check
10: Attack and Defense - Initial Access and Lateral Movement
1 - Attack & Defense Intro
2 - RDP Attack Simulation
3 - RDP Attack Investigation
4 - RDP Attack Detection
5 - RDP Attack Detection - Part 2
6 - RDP Attack Detection - Part 3
7 - PSexec Attack Simulation
8 - PSexec Attack Investigation
9 - PSexec Attack Detection
10 - WinRM Attack Simulation
11 - WinRM Attack Investigation
12 - WinRM Attack Detection
5
11: Attack and Defense - Discovery
1 - Nltest Discovery Simulation
2 - Nltest Discovery Investigation
3 - Nltest Discovery Detection
4 - Net Discovery Simulation
5 - Net Discovery Investigation
6 - Net Discovery Detection
12: Attack and Defense - Living-off-the-Land (LOLbin & Friends)
1 - The Emotet Usecase - Detecting PowerShell Attacks
2 - WMI Attack Simulation
2
3 - WMI Attack Investigation
4 - WMI Attack Detection
5 - KeyMgr Detection Bypass Red Team Edition
6 - KeyMgr Detection Bypass Red Team Edition - Part,2
13: Attack and Defense - Persistence & Credential Access
1 - Registry Persistence Attack Simulation
2 - Registry Persistence Attack Investigation
3 - Registry Persistence Attack Detection
4 - Service Persistence Attack Simulation
5 - Service Persistence Attack Investigation
6 - Service Persistence Attack Detection
7 - Startup Folder Persistence Attack Simulation
8 - Startup Folder Persistence Attack Investigation
9 - Startup Folder Persistence Attack Detection
10 - Credential Access Techniques
14: Attack and Defense - AI & Process Injection
Process Injection Tool - TrainSec Injector.zip
1 - Process Injection Techniques Attack Simulation
2 - Process Injection Techniques Attack Investigation & Detection
3 - AI Assisted Detection Engineering
4 - AI Assisted Detection Engineering - Part 2
5 - AI Assisted Detection Engineering - Part 3
15: To know your enemy, you must become your enemy - Final Notes & Labs
1 - Pro Tips
2 - Attack Simulation and Detection Engineering Practice Labs
3 - Thank you
Bonus Content
1 - Interesting Windows Folder Paths
2 - Interesting Windows Folder Paths - Part 2
3 - Interesting Windows Registry Keys
DEF CON 34 - The Silent Tunneler - A Real-World Incident Response Story