*PREMIERE*
1-Day Introduction to Threat Hunting: Skills for Identifying Hidden Threats

The introductory module of the course outlines the core principles, methodologies, and objectives of threat hunting, setting the stage for practical exploration and advanced techniques in subsequent modules.

Module focuses on understanding and analyzing system permissions to uncover potential threats, detect misconfigurations, identify attempts to hide malicious activity through permissions, and ensure proper access control for enhanced security.

Module highlights the importance of Security Descriptor Definition Language (SDDL) in uncovering hidden permissions and unclear settings, providing a clear view of resultant permissions on objects to identify potential security risks.

Module focuses on how attackers exploit privileges to gain unauthorized access, escalate their control within systems, and maintain persistence, emphasizing detection strategies and mitigation techniques to counter these threats.

Module provides an in-depth analysis of logon types, such as interactive, network, service, and remote logons, exploring how attackers leverage these methods to gain access, escalate privileges, and evade detection. The module also emphasizes detecting abnormal logon activity and misconfigurations to strengthen threat detection and response capabilities.

Module explores common mistakes in service configurations that attackers frequently exploit, such as improper access controls, unsecured paths, and excessive permissions, providing insights into identifying and mitigating these vulnerabilities. Learn 5 biggest mistakes! 

Module dives into various “pass-the” attack techniques, exploring their mechanisms and impact. The module includes forensic analysis methods, focusing on artifacts like the USN Journal and Prefetch, among other tools, to uncover evidence of these attacks and enhance threat-hunting capabilities.

Module provides a deep dive into the mechanics of Kerberos authentication, focusing on ticket creation, usage, and potential abuse. It also explores how attackers exploit directory access to manipulate tickets, gain unauthorized privileges, and persist in the environment, while equipping participants with techniques to detect such activities.

Module focuses on risk assessment by identifying where credentials are stored on the compromised machine. Participants will learn how to locate credentials, evaluate their sensitivity, and assess the potential impact of an attack based on the exposure and misuse of these credentials.

Module introduces the systematic approach to analyzing malicious software, covering key stages such as identification, static and dynamic analysis, behavioral monitoring, and reporting. This module provides a foundational understanding of how to dissect malware to uncover its functionality, objectives, and potential impact.

Module introduces foundational techniques for examining malware without executing it, focusing on analyzing file metadata, identifying file types, extracting strings, and using tools like disassemblers to gain insights into the malware’s structure and potential behavior.

Module focuses on identifying signs of packed malware, such as unusual file structures, high entropy, and suspicious section names. It equips participants with techniques to recognize packing methods and analyze packed samples effectively to uncover hidden malicious content.

Module provides an in-depth analysis of the Pony malware, focusing on its credential-stealing capabilities, command-and-control mechanisms, and obfuscation techniques. Participants will explore its architecture and learn how to detect, analyze, and mitigate this malware through real-world examples and forensic insights.

Module explores techniques for analyzing the runtime behavior of malware by monitoring its interactions with the operating system, file system, network, and memory. Participants will learn how to identify indicators of compromise, observe malicious patterns, and use sandbox environments to safely analyze malware behavior.

Module provides an overview of common malware capabilities, including data theft, system manipulation, persistence mechanisms, evasion techniques, and propagation methods. Participants will learn to recognize these functionalities during analysis to better understand the intent and impact of malicious software.

Module focuses on identifying signs of a breach through key indicators of compromise (IoCs) and leveraging Yara rules to detect and classify malicious files. Participants will learn how to create and optimize Yara rules for effective threat detection and response.

Module focuses on examining malicious code to uncover its functionality, techniques, and intent. Participants will learn to decompile, debug, and analyze malware code to identify critical components, understand its behavior, and develop effective countermeasures.

Reviewing the sample. 

Reviewing the sample. 

Module provides hands-on experience in using IDA Pro for analyzing malware statically. Participants will explore real-world examples, learning how to navigate the interface, interpret disassembled code, and identify malicious functions and behavior without executing the malware.

Module offers practical experience in using x64dbg for dynamic malware analysis. Participants will learn how to debug malicious binaries, monitor their behavior in real-time, analyze runtime modifications, and uncover hidden functionalities through step-by-step examples.