Practical Cyber Threat Hunting from Udemy

In this course students will learn counducting threat hunting and compromise assessment. In the first module I created a real life attack scenerio as an adversary simulation in a demo lab. I lecture to my students about cyber threat intelligence sources and types, basic definition and terms like I critisize security devices capabilities for explaining why we need monitoring and SIEM infrastructure. In the second module I give you therotical knowledge about real attack techniques like SQL Injection, Buffer OverFlow Exploit Codes, SSH tunneling methods and more... I teach to my students how to collect full pcap traffic and which tools should be used for analysing. In module two I analysis tunnels, pivot points, web attacks, Remote Code Execution Exploits, Web Shells and Web attacks traffic from pcap files and I share my real world analysis experince with my students. In third module, First I present the fundamental windows processes and process injections, hollowing techniques and tools, pe injection and thread injection techniques and tools as theoritically. Then I teach you dumping memory samples for memory forensic and I analyze Stuxnet attack's memory image, Cridex, Zeus, Darkcomet Rat's Memory images and DLL injection event's memory image. In fourth module I perform therat hunting over ELK. First I explain the event id numbers which are used common for hunting and I analyze a real life scenerio. I detected malicious word documents, hta files, unsigned exe files, vbs files and more. I teach you how to detect and investigate tunneling methods, persistency methods like registeries, services, schedule tasks. Some techniques are used like lolbas in attack lab and we investigate and map them by using MITRE framework. Google Rapid Response And Osquery usage and labs are performed by me.

Important Note: My Udemy Training only includes the videos. Memory images, pcaps and virtual machines aren't shared in Udemy. I am creating lab environment in a different platform in Cloud and when I complete the Lab network in cloud I will announce and You can purchase separately from this.

What's inside

Learning objective

Students will gain abilities like network forensic skills, memory forensic skills threat hunting over elk incident response skills for apt analysis and more. in this course students will learn counducting threat hunting and compromise assessment. in the first module i created a real life attack scenerio as an adversary simulation in a demo lab. i lecture to my students about cyber threat intelligence sources and types, basic definition and terms like ioc, ttp, cyber kill chain model, incident response steps. i critisize security devices capabilities for explaining why we need monitoring and siem infrastructure. in the second module i give you therotical knowledge about real attack techniques like sql injection, buffer overflow exploit codes, ssh tunneling methods and more... i teach to my students how to collect full pcap traffic and which tools should be used for analysing. in module two i analysis tunnels, pivot points, web attacks, remote code execution exploits, web shells and web attacks traffic from pcap files and i share my real world analysis experince with my students. in third module, first i present the fundamental windows processes and process injections, hollowing techniques and tools, pe injection and thread injection techniques and tools as theoritically. then i teach you dumping memory samples for memory forensic and i analyze stuxnet attack's memory image, cridex, zeus, darkcomet rat's memory images and dll injection event's memory image. in fourth module i perform therat hunting over elk. first i explain the event id numbers which are used common for hunting and i analyze a real life scenerio. i detected malicious word documents, hta files, unsigned exe files, vbs files and more. i teach you how to detect and investigate tunneling methods, persistency methods like registeries, services, schedule tasks. some techniques are used like lolbas in attack lab and we investigate and map them by using mitre framework. google rapid response and osquery usage and labs are performed by me.

Syllabus

Students will learn how to analyze cyber attacks such as Buffer over flow exploits, web attacks like SQL injection, XSS, file uploads, tunnels, and more over network traffic with analysing pcap files.

I will teach you calculating for our requirements for full packet collection. You will learn tools and systems for collecting full pcap capture in a network. Also you find out why we implement network forensic for detection.

In this lesson We analyzed basic protocols connections like Mysql, HTTP, FTP, NFS. You will learn Wireshark basics and basic protocol analysis.

Students will analyze the DNS and SMTP packets for detecting phishing attacks. They will learn how to extract malicious files from network traffic.

In this lesson student learns to detect protocol-port mismatches.

In this lesson students learn how to detect malware or attack traffic from anormal user agents.

In this lesson students learn analysing Ransomware traffic and examining the trafic patterns.

In this lesson students learn Remote Code Execution exploit mechanism theoritaclly. After that they will learn how to detect a shellcode, return address and nop values for finding exploit code in the network traffic.

In this lesson students learn how to detect SSH tunnels in the Network traffic. First I explain the SSH tunnel mechanism as theoritaclly and I show you how to establish a SSH tunnel and you will analyze it.

In this lesson students learn how to detect ICMP tunnels in the Network traffic. First I explain the ICMP tunnel mechanism as theoritaclly and I show you how to establish a ICMP tunnel and you will analyze it.

In this lesson students learn how to detect DNS tunnels in the Network traffic. First I explain the DNS tunnel mechanism as theoritaclly and I show you how to establish a DNS tunnel and you will analyze it.

You will teach you performing timeline analysis and mapping the tunnels for solving the node to clearify to pivot pionts in network.

Sql injection basics are explained in a an example source code as therotically and you will learn how to analyze and detect SQL injection in network traffic.

Command injection basics are explained in a an example source code as therotically and you will learn how to analyze and detect Command injection in network traffic.

You will learn fundamental functions of webshells and their execution analysis. In this lesson you will learn how to detect web shells in network traffic.

File Upload basics are explained in a an example source code as therotically and you will learn how to analyze and detect File upload attacks in network traffic.

RFI/LFI basics are explained in a an example source code as therotically and you will learn how to analyze and detect RFI/LFI attacks in network traffic.

You will learn to basic XSS detection by investigating network traffic.

In this module students will learn to implement memory forensic and they will understand windows processes, process hollowing, process injection and they will analyze memory dumps with volatility.

Introduction To Memory Forensic

ZEUS Botnet Malware Memory Dump Analysis

DLL Injection Memory Analysis

Stuxnet Memory Analysis

DarkComet Rat Memory Analysis

Cridex Rat Memory Analysis

In this module students will learn performing threat hunting over endpoints. They learn to analyze with ELK, mapping attacks with MITRE,, Event Numbers, GRR usage, Osquery and IOC creating.

Event ID Numbers For Hunting

Threat Hunting With ELK Part 1

Threat Hunting With ELK Part 2

Threat Hunting With ELK Part 3

Threat Hunting With ELK Part 4

Mapping Attacks With MITRE Framework

Incident Response With Google Rapid Response

Incident Response With Osquery

Malicious Document Analysis

Creating Image With FTK

Threat Hunting With VIRUS TOTAL INTELLIGENCE PLATFORM

Creating Indicator Of Compromise

Detecting Web Shells In Server Side

In this lesson you are gonna learn Cyber Kill Chain Method by watching a real life attack scenerio in a lab network. Various techniques are used like port scanning, client side attacks with malicious documents, RCE exploits, lateral movment, tunnelling techniques like ICMP, DNS, L2 VPN pivoting, socks5, web attacks, password attacks. I learn you step by step Cyber Kill Chaing during you are watching the attack cycle.

In this lesson we have created a scenerio based hacking techniques and we critisized the security devices. We created a table for talking about security devices detection and prevention capabilities for explaining our SIEM and Network Monitoring needs.

Post Activities Snort & Suricata

Career center