Detection of In & Out – Network Exfiltration and Post-Exploitation Techniques – BLUE EDITION

Course Description

UNFORTUNATELY THIS TRAINING HAS BEEN CANCELLED. WE APOLOGISE FOR ANY INCONVENIENCE 

“Detection of In & Out – Network Exfiltration and Post-Exploitation Techniques – BLUE EDITION” is an advanced lab-based training created to present participants:

• Significance of security events correlation including context to reduce the number of false positives and better detection of adversary activities
• Advanced detection methods and techniques against exfiltration and lateral movement including event mapping, grouping and tagging
• Understand tactics and behaviours of the adversary after gaining initial access to the network (Linux/Windows)
• Detection methods of tunnelling, hiding, pivoting and custom, simulated malicious network events
• Capabilities of many popular Open Source tools and integration with 3rd party security (IDS/IPS/WAF/EDR) and analytics solutions against adversaries actions
• Verification methods and techniques for product and service providers from IT Security space → in terms of internal testing and PoC / PoV programs

The main goal of the workshop is to achieve better detection of post-exploitation activities and more effective incident handling, thus allowing to reduce the number of false positives in the SOC environment. Individual detection lab cases will be launched and analyzed together in details by finding new and using existing DFIR artifacts. A modular lab-oriented form of the training allows for a later use and combination within your own SOC infrastructure, expanding and delivering complex tactics, techniques and procedures (TTP).

Individual artifacts of “RED” actions will be linked, properly characterized, tagged and grouped taking into account the level of criticality, mapping to the MITRE ATT&CK Framework and chain-linking events/pieces of evidence that make up a given security incident.

The workshop is filled with substantive examples / contextual insertions from the community world of Threat hunting, Blue / Red, including the source of origin.

An integral element of the workshop is a DFIR quiz consisting of presenting real cases of suspicious activities in the form of describing artifacts offline.

The entire training is based on a purely practical laboratory in which the student independently performs each action or related scenarios in a dedicated virtual laboratory network. This class focuses on x86 / x64 architecture, IPv4 / IPv6 networks and targets distributed Linux and Windows environments (AD 2016, 10, 7).

In terms of IDS / IPS / Data Leakage Protection and for a better understanding of the current status of your network security position, training experience will help you understand the risks, identify dead points of your network security and undiscovered infrastructure spaces by simulating and detecting the actions of a real cyber-threat actor.

The proposed training BLUE agenda – in the defensive edition –  is a natural continuation of the first → offensive (RED) edition of the training. Highly technical content and only a practical approach guarantees that the use of the transferred knowledge and technologies in real production environments will be easy, smooth and repeatable.

Make sure your network’s security really works!