Our six-day journey will start with an analysis of recent attacks through in-depth case studies. We will explain what types of attacks are occurring and introduce the Advanced Persistent Threat (APT) Attack Cycle as a structured approach to describing attacks. In order to understand how attacks work, you will also compromise our virtual organization “SyncTechLabs” in our Day 1 exercises.

Throughout days 2 through 5 we will discuss how effective security controls can be implemented to prevent, detect, and respond to cyber attacks. Some of the topics we will address include:

• How red and blue teams can improve collaboration, forming a true purple team;
• How current advanced adversaries are breaching our defenses;
• Security controls structured around the Kill Chain, including:
  • Setting up a fundamental detection capability using ELK, OSQuery, and Suricata
  • Building your own mail sandbox solution to stop spear phishing using Suricata and Cuckoo
  • Leveraging YARA rules to detect malicious payloads on disk and in memory
  • Developing effective group policies to stop malicious code execution and implement script control (AppLocker, Software Restriction Policies, Script hardening, etc.)
  • Stopping 0-day exploits using exploit mitigation techniques (leveraging EMET and ExploitGuard)
  • Preventing malware persistence using least-privilege (UAC, Just-Enough-Admin, privileged account management, etc.)
  • Detecting malware persistence using OSQuery
  • Preventing lateral movement by hardening Windows Active Directory environments (e.g. CredentialGuard, Privileged Access Workstations, Protected Processes, etc.)
  • Detecting lateral movement through Sysmon and Windows event monitoring
  • Blocking and detecting command and control through network traffic analysis
  • Managing, sharing and operationalizing threat intelligence using MISP
  • Hunting for compromise in the network by leveraging Loki

In designing the course and its exercises, the authors went the extra mile to ensure that attendees “build” something that can be used later on. For this reason, the different technologies illustrated throughout the course (e.g., IDS systems, web proxies, sandboxes, visualization dashboards, etc.) will be provided as usable virtual machines on the course USB.

SEC599 will finish with a bang. During the “Defend-the-Flag” challenge on the final course day you will be pitted against advanced adversaries in an attempt to keep your network secure. Can you protect the environment against the different waves of attacks? The adversaries aren’t slowing down, so what are you waiting for?