FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

FOR572: ADVANCED NETWORK FORENSICS: THREAT HUNTING, ANALYSIS AND INCIDENT RESPONSE was designed to cover the most critical skills needed for the increased focus on network communications and artifacts in today's investigative work, including numerous use cases. Many investigative teams are incorporating proactive threat hunting to their skills in which existing evidence is used with newly acquired threat intelligence to uncover evidence of previously unidentified incidents. Others focus on post-incident investigations and reporting. Still others engage with an adversary in real time, seeking to contain and eradicate the attacker from the victim's environment. In these situations and more, the artifacts left behind from attackers' communications can provide an invaluable view into their intent, capabilities, successes, and failures.

FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response
Size: 134 GB
Contains: 572 Files, 51 Folders

You Will Be Able To.
- Extract files from network packet captures and proxy cache files, allowing follow-on malware analysis or definitive data loss determinations.
- Use historical NetFlow data to identify relevant past network occurrences, allowing accurate incident scoping.
- Reverse engineer custom network protocols to identify an attacker's command-and-control abilities and actions.
- Decrypt captured SSL/TLS traffic to identify attackers' actions and what data they extracted from the victim.
- Use data from typical network protocols to increase the fidelity of the investigation's findings.
- Identify opportunities to collect additional evidence based on the existing systems and platforms within a network architecture.
- Examine traffic using common network protocols to identify patterns of activity or specific actions that warrant further investigation.
- Incorporate log data into a comprehensive analytic process, filling knowledge gaps that may be far in the past.
- Learn how attackers leverage meddler-in-the-middle tools to intercept seemingly secure communications.
- Examine proprietary network protocols to determine what actions occurred on the endpoint systems.
- Analyze wireless network traffic to find evidence of malicious activity.
- Use scripting techniques to scale analysis to an arbitrarily large collection of evidence.
- Apply the knowledge you acquire during the week in a full-day capstone lab, modeled after real-world nation-state intrusions and threat actors.

Course Syllabus.
FOR572.1: Off the Disk and Onto the Wire
FOR572.2: Core Protocols & Log Aggregation/Analysis
FOR572.3: NetFlow and File Access Protocols
FOR572.4: Commercial Tools, Wireless, and Full-Packet Hunting
FOR572.5: Encryption , Protocol Reversing, OPSEC, and Intel
FOR572.6: Network Forensics Capstone Challenge

FOR EDUCATIONAL PURPOSES ONLY!