Hacker Techniques Tools And Incident Handling Pdf Free Download UPDATED
Hacker Techniques Tools And Incident Handling Pdf Free Download
- In Person (6 days)
- Online
38 CPEs
SEC504 helps you lot develop the skills to conduct incident response investigations. You will larn how to employ a dynamic incident response process to evolving cyber threats, and how to develop threat intelligence to mountain constructive defense strategies for cloud and on-premises platforms. We'll examine the latest threats to organizations, from watering pigsty attacks to endpoint security bypass, enabling you to become into the mindset of attackers and anticipate their moves. SEC504 gives you the information yous need to empathise how attackers scan, exploit, pivot, and found persistence in cloud and conventional systems. To help y'all develop retentiveness and long-term remember of the course material, l percent of class time is spent on hands-on exercises, using visual association tools to pause down complex topics. This course prepares you to conduct cyber investigations and volition boost your career by helping you develop these in-demand skills.
The goal of modernistic deject and on-premises systems is to forestall compromise, but the reality is that detection and response are critical. Keeping your organization out of the alienation headlines depends on how well incidents are handled to minimize loss to the company.
In SEC504, y'all will acquire how to utilise a dynamic approach to incident response. Using indicators of compromise, you will practice the steps to effectively respond to breaches affecting Windows, Linux, and cloud platforms. You volition be able to take the skills and easily-on experience gained in the course back to the part and use them immediately.
Understanding the steps to effectively acquit incident response is only one office of the equation. To fully grasp the actions attackers take against an organization, from initial compromise to internal network pivoting, you also need to empathise their tools and techniques. In the hands-on environment provided by SEC504, you lotll utilize the tools of the attackers themselves in order to understand how they are practical and the artifacts the attackers leave behind. By getting into the mindset of attackers, y'all will learn how they utilize their trade against your organisation, and youll exist able to utilise that insight to anticipate their moves and build ameliorate defenses.
In SEC504, you volition acquire:
- How to apply a dynamic approach to incident response
- How to identify threats using host, network, and log assay
- Best practices for effective cloud incident response
- Cyber investigation processes using live analysis, network insight, and retentiveness forensics
- Defense spotlight strategies to protect critical avails
- Assailant techniques to evade endpoint detection tools
- How attackers exploit complex deject vulnerabilities
- Assailant steps for internal discovery and lateral motility after an initial compromise
- The nigh effective attacks to featherbed system access controls
- The crafty techniques attackers employ, and how to stop them
SANS Video 
-
Overview
The commencement department of SEC504 focuses on how to develop and build an incident response procedure in your arrangement by applying the Dynamic Approach to Incident Response (DAIR) to effectively verify, scope, contain, assess, and remediate threats. We'll utilize this process in-depth with easily-on labs and examples from real-globe compromises.
Exercises
- Alive Windows test
- Network investigation
- Retention investigation
- Malware investigation
- Cloud investigation
Topics
Incident Response
- Example study: Argous Corporation compromise
- Dynamic Approach to Incident Response
- Investigative analysis: Examining incident bear witness
Digital Investigations
- Techniques for digital investigation
- Establishing an incident timeline
- Investigation efficiency: Information reduction
Live Exam
- Identifying suspicious Windows processes
- Correlating network and persistence activity
- Enumerating Windows auto-first extensibility points
- Leveraging Sysinternals for live Windows examinations
Network Investigations
- Identifying compromised host beaconing with proxy server logs
- Filtering network activity to identify indicators of compromise
- Assessing encrypted network traffic with multiple information sources
- Edifice the incident timeline
Retentiveness Investigations
- Collecting volatile memory from a compromised host
- Conducting offline analysis of attacker persistence
- Using Volatility to inspect aggressor malware
Malware Investigations
- Assessing attacker malware in a custom test surround
- Using snapshot and continuous recording tools
- Inspecting malware deportment with RegShot and Procmon
- Identifying malicious code on Windows
Cloud Investigations
- Steps for conducting a cloud security incident investigation
- Essential cloud logging avails for incident response
- Information collection and isolation for compromise assessment
- Applying cloud recovery and remediation following an incident
- Complete cloud compromise incident response walkthrough
Bootcamp: Linux Olympics
- Building command line skills at your own footstep
- Working with Linux file systems and permissions
- Using JQ to parse and filter JSON data
- Using file parsing tools, including grep, cut, and awk
- Linux compromise incident response walkthrough
-
Overview
In this course department we'll look at the techniques attackers utilise to bear reconnaissance as a pre-attack step, including how they use open-source intelligence, network scanning, and target enumeration attacks to find the gaps in your network security. You'll use attacker techniques to assess the security of a target network, evaluating popular protocols and endpoints for Windows, Linux, and cloud targets. Later delivering the attacks, you'll investigate the logging information and show that remains to recognize these attacks as they happen.
Exercises
- Open-Source Intelligence with SpiderFoot
- Domain Proper noun System (DNS) Reconnaissance and Enumeration
- Host Discovery and Cess with Nmap
- Shadow Cloud Asset Discovery with Masscan
- Windows Server Bulletin Block (SMB) Session Attacks
- Windows Countersign Spray Assail Detection
Topics
MITRE ATT&CK Framework Introduction
- Using ATT&CK to guide an incident response investigation
- Staying current with changing attack techniques
- Leveraging ATT&CK for threat intelligence
Open-Source Intelligence
- Enumerating targets without being detected
- Host identification through domain and public certificate authority information
- User account compromise assessment
- Automating open-source intelligence drove with SpiderFoot
DNS Interrogation
- Mining public DNS servers for system data
- Automating host enumeration with dns-brute
- DNS server log inspection for attack identification
- Creative host identification using manual and automated tools
Website Reconnaissance
- Data-gathering from public websites
- Parsing Exchangeable Image File Format (EXIF) data from public documents
- Optimizing search engine reconnaissance interrogation
- Abstracting assault identification using public sources
- Limiting website-sensitive information disclosure
Network and Host Scanning with Nmap
- Host enumeration and discovery with Nmap
- Internal and external network mapping and visualization
- Minimizing network activity to avoid detection
- Deep host assessment with Nmap Scripting Engine tools
Deject Spotlight: Deject Scanning
Enumerating shadow cloud targets
- Accelerating scans with Masscan
- Walkthrough: Scanning Amazon Web Services for target discovery
- Attributing cloud hosts to a target organization
- Visual representation of identified targets with EyeWitness
Server Message Block (SMB) Sessions
- Understanding Windows SMB: Essential skill development
- Identifying SMB attacks confronting Windows
- Using congenital-in tools for SMB password guessing attacks
- Enumerating Windows domains using SharpView and BloodHound
- Understanding SMB security features
Defense Spotlight: DeepBlueCLI
- Identifying attacks using Windows Event Logs
- Differentiating attacks from simulated positives
- Remote host assessment for compromise identification
- Tips for fast assessment to begin incident analysis
-
Overview
Password attacks are the nearly reliable mechanism for attackers to bypass defenses and proceeds access to your system's assets. In this course section we'll investigate the circuitous attacks that exploit password and multi-gene hallmark weaknesses using the admission gained to access other network targets.
Exercises
- Password Guessing Attacks with Hydra
- Password Bang-up with John the Ripper
- Password Cracking with Hashcat
- Domain Password Audit Tool
- Cloud Bucket Discovery
- The Many Uses of Netcat
Topics
Countersign Attacks
- Password assault trifecta: Guessing, spray, and credential stuffing
- Techniques for bypassing password attack defenses
- Understanding real-world authentication attacks
Agreement Password Hashes
- Weaknesses in Windows password hash formats
- Collecting countersign hashes in Windows, Linux, and cloud targets
- Mitigating GPU-based password nifty with scrypt and Argon2
Password Cracking
- Recovering passwords from hashes with John the Ripper and Hashcat
- Accelerating countersign great with GPUs and cloud assets
- Effective slap-up with countersign policy masks
- Multi-factor hallmark and password cracking implications
Defence Spotlight: Domain Password Audit Tool (DPAT)
- Password nifty equally a defense force opportunity with the DPAT
- Collecting Windows domain hashes for security analysis
- Identifying systemic vulnerabilities in password selection
- Safely reporting on countersign selection faults
Cloud Spotlight: Insecure Storage
- Example report: Cloud bucket storage exposure
- Understanding cloud storage for Amazon Web Services, Azure, and Google Compute
- Discovering insecure bucket storage
- Walkthrough: Insecure storage to website persistence compromise
- Identifying insecure cloud storage admission
Multi-purpose Netcat
- Internal data transfer to evade monitoring controls
- Pivoting and lateral movement
- Listener and reverse TCP backdoors on Linux and Windows
- Detailed expect at aggressor post-compromise techniques
-
Overview
In this course section we'll brainstorm our look at target exploitation frameworks that take advantage of weaknesses on public servers and client-side vulnerabilities. Using the implicit trust of a public website, you lot'll employ attacker tools and techniques to exploit browser vulnerabilities, execute lawmaking with Microsoft Part documents, and exploit the many vulnerabilities associated with vulnerable web applications.
Exercises
- Metasploit Attack and Analysis
- Customer-side Exploitation with the Browser Exploitation Framework (BeEF)
- Windows System Resource Usage Database Analysis
- Command Injection Assault
- Cross-Site Scripting Set on
- SQL Injection Assail
- Server Side Request Forgery (SSRF) and Case Metadata Service (IMDS) Assault
Topics
Metasploit Framework
- Using Metasploit to place, configure, and evangelize exploits
- Selecting payloads that grant access while evading defenses
- Establishing and using Command & Command (C2) victim admission
- Identifying Metasploit and Meterpreter fingerprints for incident response
Drive-By Attacks
- Phishing and malicious Microsoft Office files
- Leveraging a watering hole to attack victim browsers
- Case study: Command system attack through watering hole forum compromise
- Building extensible payloads for constructive attacks
- Customizing exploits for defense force bypass
Defense Spotlight: Arrangement Resources Usage Monitor
- Leveraging Windows diagnostics for incident response
- Assessing incident network activity using built-in Windows data
- Case written report: Information theft and terminated employee workstation analysis
Command Injection
- Compromising websites with command injection
- Walkthrough: Falsimentis community service website set on
- Applying command injection in non-website targets
- Attack access enumeration through command injection
- Auditing web applications for command injection flaws
Cross-Site Scripting (XSS)
- Exploiting victim browsers through server flaws
- Classifying XSS types for opportunistic or target attacks
- Cookie theft, password harvesting, and camera/microphone capture attacks
- Using content security policies (CSP) to stop XSS
SQL Injection
- Understanding SQL constructs and programmer errors
- Extracting data through SQL injection
- Using Sqlmap to automate vulnerability discovery
- SQL injection against cloud databases: Relational Database Service (RDS), Spanner, Azure SQL
Cloud Spotlight: SSRF and IMDS Attacks
- Identifying server-side request forgery vulnerabilities
- Understanding mutual requests vs. server-side requests
- Walkthrough: Falsimentis federated SSO attack
- Obtaining cloud keys through IMDS attacks
-
Overview
Building on countersign, public-facing, and drive-by attacks, we'll look at the attacks that happen after initial exploitation. You'll see how attackers bypass endpoint protection systems and use an initial foothold to gain access to internal network targets. You'll and then apply the techniques yous learn with privileged insider Local Area Network (LAN) attacks, using privileged access to establish persistence, how attackers scan for and collect data from a compromised system. You will utilize these skills to appraise the security risks of a vulnerable cloud deployment through visualization and automatic assessment techniques. Finally, we'll look at the steps to have subsequently the class is over, turning what you lot've learned into long-term skills and helping you prepare for the certification exam.
Exercises
- Pivoting and Lateral Movement with Metasploit
- Insider Assail with Responder
- Windows Data Hiding: Alternate Data Streams
- Establishing Persistence with Metasploit
- Network Threat Hunting with Real Intelligence Threat Analytics (RITA)
- Deject Configuration Assessment with ScoutSuite
- Building Review Cards with Anki
Topics
Endpoint Security Bypass
- Applying ghostwriting to evade signature detection
- Evading application safelist controls
- Using signed executables to evade endpoint controls
- Getting the nigh value from Endpoint Detection and Response (EDR) platforms
Pivoting and Lateral Movement
- Using Metasploit features for lateral movement
- Attacker detection evasion through pivoting
- Using Linux and Windows features for advanced exploitation
- Command & Control (C2) for privileged internal access
Hijacking Attacks
- Exploiting privileged LAN access
- Attacking default Windows vulnerable protocols
- Password harvesting on the LAN
Covering Tracks
- Hiding collected data on Windows and Linux
- Log editing techniques for both unproblematic and complex log formats
- Edifice tamper-proof logging platforms
Establishing Persistence
- Exploiting Windows Silent Process Exit
- Windows Direction Instrumentation (WMI) Event Subscription persistence techniques
- Exploiting Windows Agile Directory: Gold Ticket attacks
- Web trounce access and multi-platform persistence
- Cloud keys and backdoor accounts in Azure, Amazon Web Services, and Google Compute
Defence force Spotlight: Real Intelligence Threat Analytics
- Threat hunting through network assay
- Identifying beacons and C2 on your network
- Characterizing network oddities: Long connections
- Catching DNS exfiltration and access attacks
Data Collection
- Linux and Windows post-exploitation password harvesting
- Evading detection controls: Mimikatz
- Attacking password managers on Windows and macOS
- Keystroke logging attacks
Cloud Spotlight: Cloud Mail-Exploitation
- Privilege enumeration and escalation in deject environments
- Identifying stealthy backdoors in Azure
- Using cloud attack frameworks: Pacu and GCP PrivEsc
- Example study: Admission to database dumping in Google Compute
- Built-in tools for data access: Microsoft 365 Compliance Search
- Assessing your deject deployment for vulnerabilities
Where to Go from Hither
- Tips for developing long-term recall and memory retention
- Applying spaced repetition theory using Anki
- Staying motivated and finding time for skill development
- Recommendations for passing your certification exam
-
Overview
Our Capture-the-Flag event is a full day of easily-on activity that has yous working equally a consultant for ISS Playlist, a fictitious company that has recently been compromised. You volition apply all of the skills yous've learned in class, using the same techniques used by attackers to compromise modern, sophisticated network environments. You will piece of work on a team or independently to browse, exploit, and complete post-exploitation tasks confronting a cyber range of target systems including Windows, Linux, Cyberspace of Things devices, and deject targets. This easily-on challenge is designed to assistance players practise their skills and reinforce concepts learned throughout the course. With an integrated hint system to give you the on-demand guidance you demand to succeed, the upshot guides you through the steps to successfully compromise target systems, bypass endpoint protection platforms, pivot to internal network high-value hosts, and exfiltrate company information.
Topics
- Target Discovery and Enumeration
- Applying Open-Source Intelligence and Reconnaissance Information-Gathering
- Public-Facing Asset Compromise
- Email Compromise
- Attacking Windows Active Directory
- Countersign Spray, Guessing, and Credential Stuffing Attacks
- Post-Exploitation Pivoting and Lateral Motion
- Choosing, Configuring, and Delivering Exploits
- Internal Attacker Compromise Attribution
The GIAC Incident Handler certification validates a practitioner's ability to detect, respond, and resolve computer security incidents using a wide range of essential security skills. GCIH certification holders have the cognition needed to manage security incidents by understanding common attack techniques, vectors and tools, as well as defend against and answer to such attacks when they occur.
- Incident Treatment and Calculator Crime Investigation
- Computer and Network Hacker Exploits
- Hacker Tools (Nmap, Nessus, Metasploit and Netcat)
More Certification Details
Important! Bring your ain system configured according to these instructions!
A properly configured organization is required to fully participate in this course. If yous do not carefully read and follow these instructions, you will probable exit the class unsatisfied because yous volition non be able to participate in hands-on exercises that are essential to this class. Therefore, we strongly urge yous to arrive with a system meeting all the requirements specified for the grade.
It is disquisitional that you back-upwardly your system before class. It is also strongly advised that you lot do non bring a system storing any sensitive information.
CPU
- 64-bit Intel i5/i7 2.0+ GHz processor
- CRITICAL NOTE: Apple tree systems using the M1 processor line cannot perform the necessary virtualization functionality and therefore cannot in whatever way be used for this course.
- Your system's processor must be a 64-bit Intel i5 or i7 2.0 GHz processor or higher. To verify on Windows x, printing Windows key + "I" to open Settings, so click "Organisation", then "About". Your processor information will be listed most the lesser of the folio. To verify on a Mac, click the Apple logo at the peak left-mitt corner of your display and then click "Nearly this Mac".
BIOS
- Enabled "Intel-VT"
- Intel's VT (VT-x) hardware virtualization technology must exist enabled in your arrangement'due south BIOS or UEFI settings. Y'all must be able to access your system'due south BIOS to enable this setting in order to complete lab exercises. If your BIOS is password-protected, yous must have the password. This is absolutely required.
RAM
- sixteen GB RAM is highly recommended for the all-time experience. To verify on Windows 10, press Windows key + "I" to open up Settings, then click "System", then "About". Your RAM information volition be toward the bottom of the page. To verify on a Mac, click the Apple logo at the top left-hand corner of your brandish and then click "Near this Mac".
Hard Bulldoze Free Space
- 100 GB of FREE space on the hard bulldoze is critical to host the VMs and boosted files we distribute. SSD drives are also highly recommended, as they permit virtual machines to run much faster than mechanical hard drives.
Operating Organization
- Your arrangement must exist running either the latest version of Windows x, macOS 10.15.x or after, or Linux that also tin can install and run VMware virtualization products described below.
Additional Software Requirements
VMware Actor Install
- VMware Workstation Histrion sixteen, VMware Fusion 12, or VMware Workstation 16
- Install VMware Player 16, VMware Fusion 12, or VMware Workstation xvi. Older versions will not work for this course. Choose the version uniform with your host Bone. If you do not ain a licensed copy of VMware Workstation or Fusion, you can download a free 30-solar day trial copy from VMware. VMware volition transport you a time-limited serial number if you register for the trial at their Web site. VMware Workstation Player is a free download that does not need a commercial license only has fewer features than Workstation. THIS IS CRITICAL: Other virtualization products, such as Hyper-V and VirtualBox, are non supported and volition not work with the course textile.
Your class media will now be delivered via download. The media files for form can be large, some in the 40 - l GB range. You demand to let enough of fourth dimension for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is non possible to give an estimate of the length of fourth dimension information technology will take to download your materials. Please start your course media downloads as y'all get the link. You will need your form media immediately on the commencement mean solar day of form. Waiting until the night before the class starts to brainstorm your download has a high probability of failure.
SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have establish that a second monitor and/or a tablet device tin be useful by keeping the class materials visible while the instructor is presenting or while yous are working on lab exercises.
If you accept additional questions about the laptop specifications, please contact laptop_prep@sans.org.
"Assaulter tools and techniques have changed, and we need to modify our incident response techniques to match. Since I took over every bit author of SEC504 in 2019, I accept rewritten the entire grade to give you lot the skills you need to succeed at incident response. Whether the attacks are Windows-focused or involve attacking critical database platforms or exploiting cloud vulnerabilities, you'll be prepared to effectively identify the assail, minimize the bear on, and respond efficiently. With your knowledge of hacker tools and techniques, and by using defense skills that dramatically meliorate security, you will be prepare to become the subject-matter skillful your organisation needs to encounter today's cyber threats. "
-Joshua Wright
"Our teacher Josh was incredible! Engaging, enthusiastic, extremely knowledgeable (especially vim, WOW). His enthusiasm is contagious and actually motivating to the cloth. Keep upwards the great piece of work Josh!" - Jen F., US Federal Agency
DOWNLOAD HERE
Posted by: wilbanksanall1968.blogspot.com
