In & Out – Detection as Code vs Adversary Simulations – Purple Edition

Course Description

In & Out – Detection as Code vs Adversary Simulations – Purple Edition is an advanced lab-based training created to present participants: 

• Significance of security events correlation including context to reduce the number of false positives and better detection of adversary activities 
• Advanced detection methods and techniques against exfiltration and lateral movement including event mapping, grouping, and tagging 
• Understand the tactics and behaviours of the adversary after gaining initial access to the network (Linux/Windows) 
• Detection methods of C2 traffic, tunnelling, hiding, pivoting and custom, simulated malicious network events 
• Capabilities of many popular Open Source tools and integration with 3rd party security (IDS/IPS/WAF/EDR/FPC) and analytics solutions against adversaries C2-based actions 
• Verification methods and techniques for product and service providers from IT Security space → in terms of internal testing and PoC / PoV programs 

The primary goal of this training is to generate offensive attack events/symptoms within PurpleLABS infrastructure that later should be detected by Open Source SOC stack including Sigma – the open standard event description rule set and the rest of dedicated, open-source security solutions in use. In this way, participants will thoroughly familiarize themselves with the content of the available Sigma detection rules and their structure, better understand the essence of offensive actions, learn the low-level relationships between data sources, and thus achieve knowledge in creating their own detection rules and eventually bypassing them. We called this approach ‘Flip mode’, i.e. learn detection through the attack in an attractive, standardized form driven by the Open Source community. In addition, participants will use a whole range of open-source (and free commercial) solutions dedicated to SOC environments. 

We believe that the unique approach of ‘Detection as Code vs Adversary Simulations’ in a condensed format will allow increasing the level of knowledge in the field of RED / BLUE / PURPLE to both experienced specialists and beginners while maintaining the attractiveness and pleasure of performed tasks – detection does not have to be boring and tedious! 

Virtual infrastructure 

This training is based on PurpleLABS – a dedicated virtual infrastructure for conducting detection and analysis of attackers’ behaviour in terms of used techniques, tactics, procedures, and offensive tools. The environment has been set up to serve the constant improvement of competences in the field of threat hunting (threat hunting) and learning about current trends of offensive actions (red-teaming) vs detection phases (blue-teaming). 

PurpleLABS provides analytical interfaces for all relevant data sources from individual systems and network services available in the virtual infrastructure (sysmon, windows events, fw, bro, suricata, fpc, osquery, auth, powershell, waf, proxy, audit, and more). 

Saying that you will get a chance for doing *bonus* detection and hunting steps against all the offensive labs we have available during the training. The coolest thing is after the training you will get an additional 14-days of access to PurpleLabs! Just take a look: https://www.defensive-security.com/purplelabs/ 

Key Learning Objectives 

• Learn ways to improve your detection and event correlations skills across many different data sources 
• Find the malicious activities and identify threats details on the network 
• Prepare your SOC team for fast filtering out network noise and allow for better incident response handling 
• Profile your critical OS and network segments in terms of ‘normal vs exotic’ behaviour 
• Find out how DFIR / IR Open Source Software can support your SIEM infrastructure 
• Learn current trends, techniques, and tools for network exfiltration and lateral movements 
• Understand the value of DLP / IDS / IPS / FW / WAF / Memory Forensics against real adversary lab scenarios 
• Understand values from an automated approach to simulating attackers and generating anomalies 
• Identify blind spots in your network security posture 

Then this training is for you!