Overview
FOR508: Advanced Digital Forensics, Incident Response, and Theat Hunting will help you to:
Detect how and when a breach occurred Identify compromised and affected systems
Determine what attackers took or changed
Contain and remediate incidents
Develop key sources of threat intelligence
Hunt down additional breaches using knowledge of the adversary
DAY 0: A 3-letter government agency contacts you to say an advanced threat group is targeting organizations like
yours, and that your organization is likely a target. They won’t tell how they know, but they suspect that there are already several breached systems within your enterprise. An advanced persistent threat, aka an APT, is likely involved.
This is the most sophisticated threat that you are likely to face in your efforts to defend your systems and data, and these adversaries may have been actively rummaging through your network undetected for months or even years.
This is a hypothetical situation, but the chances are very high that hidden threats already exist inside your organization’s networks. Organizations can’t afford to believe that their security measures are perfect and impenetrable, no matter how thorough their security precautions might be. Prevention systems alone are insufficient to counter focused human adversaries who know how to get around most security and monitoring tools.
“This is, by far, the best training I have ever had. My forensic knowledge increased more in the last week than in the last year.”
-Vito Rocco, UNLV
This in-depth incident response and threat hunting course provides responders and threat hunting teams with advanced skills to hunt down, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hactivism.
Constantly updated, FOR508: Advanced Digital Forensics, Incident Response, and Threat Hunting addresses today’s incidents by providing hands-on incident response and threat hunting tactics and techniques that elite responders and hunters are successfully using to detect, counter, and respond to real-world breach cases.
Course Outline :: FOR508::
Who Should Attend
Incident response team members
Threat hunters
Experienced digital forensic analysts
Information security professionals
Federal agents and law enforcement
Red team members, penetration testers, and exploit developers
SANS FOR500 (formerly FOR408) and SEC504 graduates
You Will Be Able To
Learn and master the tools, techniques, and procedures necessary to effectively hunt, detect, and contain a variety of adversaries and to remediate incidents
Detect and hunt unknown live, dormant, and custom malware in memory across multiple Windows systems in an enterprise environment
Hunt through and perform incident response across hundreds of unique systems simultaneously using FResponse Enterprise and the SIFT Workstation
Identify and track malware beaconing outbound to its command and control (C2) channel via memory forensics, registry analysis, and network connection residue
Determine how the breach occurred by identifying the beachhead and spear phishing attack mechanisms
Target advanced adversary anti-forensics techniques like hidden and time-stomped malware, along with utility-ware used to move in the network and maintain an attacker’s presence
Use memory analysis, incident response, and threat hunting tools in the SIFT Workstation to detect hidden processes, malware, attacker command lines, rootkits, network connections, and more
Track user and attacker activity second-by-second on the system you are analyzing through in-depth timeline and super-timeline analysis
Recover data cleared using anti-forensics techniques via Volume
Shadow Copy and Restore Point analysis
Identify lateral movement and pivots within your enterprise, showing how attackers transition from system to system without detection
Understand how the attacker can acquire legitimate credentials
- – including domain administrator rights – even in a locked-down environment
Track data movement as the attackers collect critical data and shift them to exfiltration collection points
Recover and analyze archives and .rar files used by APT-like attackers to exfiltrate sensitive data from the enterprise network
Course Outline :: FOR508::
Use collected data to perform effective remediation across the entire enterprise
Course Outline
508.1 HANDS ON: Advanced Incident Response and Threat Hunting
Incident responders and threat hunters should be armed with the latest tools, memory analysis techniques, and enterprise methodologies to identify, track, and contain advanced adversaries and to remediate incidents. Incident response and threat hunting analysts must be able to scale their analysis across thousands of systems in their enterprise. This section examines the six-step incident response methodology as it applies to an enterprise’s response to a targeted attack.
Topics: Real Incident Response Tactics; Threat Hunting; Cyber Threat Intelligence; Threat Hunting in the Enterprise;
Malware Persistence Identification; Remote and Enterprise Incident Response
508.2 HANDS ON: Memory Forensics in Incident Response & Threat Hunting
Now a critical component of many incident response and threat hunting teams that detect advanced threats in their organization, memory forensics has come a long way in just a few years. Memory forensics can be extraordinarily effective at finding evidence of worms, rootkits, and advanced malware used by an APT group of attackers. This extremely popular section will introduce some of the most capable tools available and give you a solid foundation to add core and advanced memory forensic skills to your incident response and forensics capabilities.
Topics: Memory Acquisition; Memory Forensics Analysis Process for Response and Hunting; Memory Forensics
Examinations; Memory Analysis Tools
508.3 HANDS ON: Intrusion Forensics
Cyber defenders have a wide variety of tools and artifacts available to identify, hunt, and track adversary activity in a network. Each attacker’s action leaves a corresponding artifact, and understanding what is left behind as footprints can be critical to both red and blue team members. Attacks follow a predictable pattern, and we focus our detective efforts on immutable portions of that pattern. In this section, we cover common attacker tradecraft and discuss the various data sources and forensic tools you can use to identify malicious activity in the enterprise.
Topics: Advanced Evidence of Execution Detection; Window Shadow Volume Copy Analysis; Lateral Movement
Adversary Tactics, Techniques, and Procedures (TTPs); Event Log Analysis for Incident Responders and Hunters
508.4 HANDS ON: Timeline Analysis
Learn advanced incident response and hunting techniques uncovered via timeline analysis directly from the authors who pioneered timeline analysis tradecraft. This section will step you through the two primary methods of building and analyzing timelines created during advanced incident response, threat hunting, and forensic cases. Exercises will
Course Outline :: FOR508::
show analysts how to create a timeline and also how to introduce the key methods to help you use those timelines effectively in your cases.
Topics: Timeline Analysis Overview; Memory Analysis Timeline Creation; Filesystem Timeline Creation & Analysis;
Super Timeline Creation and Analysis
508.5 HANDS ON: Incident Response and Hunting Across the Enterprise – Advanced Adversary and Anti-Forensics
Detection
Over the years, we have observed that many incident responders and threat hunters have a challenging time finding threats without pre-built indicators of compromise or threat intelligence gathered before a breach. This is especially true in APT adversary intrusions. This advanced session will demonstrate techniques used by first responders to identify malware or forensic artifacts when very little information exists about their capabilities or hidden locations.
We will discuss techniques to help funnel possibilities down to the candidates most likely to be evil malware trying to hide on the system.
Topics: Evolution of Incident Response Scripting; Malware and Anti-Forensic Detection; Anti-Forensic Detection
Methodologies; Identifying Compromised Hosts without Active Malware
508.6 HANDS ON: The APT Incident Response Challenge
This incredibly rich and realistic enterprise intrusion exercise is based on a real-world advanced persistent threat (APT) group. It brings together techniques learned earlier in the week and tests your newly acquired skills in a case that simulates an attack by an advanced adversary. The challenge brings it all together using a real intrusion into a complete
Windows enterprise environment. You will be asked to uncover how the systems were compromised in the initial intrusion, find other systems the adversary moved to laterally, and identify intellectual property stolen via data exfiltration. You will walk out of the course with hands-on experience investigating realistic attacks, curated by a cadre of instructors with decades of experience fighting advanced threats from attackers ranging from nation-states to financial crime syndicates and hactivist groups.
Topics: Identification and Scoping; Containment and Threat Intelligence Gathering; Remediation and Recovery
Programme scope, delivery arrangements and suitability are confirmed during enquiry.