deep knowledge technical trainings

APRIL 17 - 25 @ MOVENPICK AMSTERDAM

Linux Forensics Inspection and Incident Response at Scale (Ams)

This course takes on an “attack vs detection” approach in a condensed format. This class is intended for students who have basic understanding of Linux and have to deal with advanced threats. Furthermore, the course is also interesting for experienced DFIR/SOC/CERT players who aim to dig deeper into understanding of Linux internals and corresponding network attack analysis techniques, detection and response.

Categories 3-Day Training, HITB2023AMS, Virtual

€3,299.00

Duration

3-day

Delivery Method

Virtual

Level

intermediate

Seats Available

20 REGISTRATION CLOSED

DATE: 17-19 April 2023

TIME: 09:00 to 17:00 CEST/GMT+2

Date	Day	Time	Duration
17 Apr	Monday	0900-17:00 CEST/GMT+2	8 Hours
18 Apr	Tuesday	0900-17:00 CEST/GMT+2	8 Hours
19 Apr	Wednesday	0900-17:00 CEST/GMT+2	8 Hours

Full access to the PurpleLabs environment for 30 days post-training!

Through the hands-on labs, you will gain a perfect understanding of important DFIR Linux/Network internals and investigation steps needed to get the full picture of post-exploitation activities and artifacts left behind. At scale.

Attackers constantly find new ways to attack and infect Linux boxes using more and more sophisticated techniques and tools. As defenders we need to stay up to date with adversaries, understand their TTPs and be able to respond quickly. The combination of low-level network and endpoint visibility is crucial to achieve that goal. For DFIR needs we could go even further with proactive forensics inspections. This training will guide you through different attack-detection-inspection-response use-cases and teach critical aspects of how to handle Linux incidents properly.

For a comprehensive mindmap of this training, click here

Topics Covered

Introduction to PurpleLabs Hunting and Detection tools including Velociraptor, Wazuh, HELK+Sigma, Splunk, Elastiflow, Moloch/Arkime, Kolide Fleet, Graylog, theHive, Sandfly and more
Linux profile baselining
How to run DFIR tasks at scale across many Linux endpoints
Recent Linux APT analysis
RE&CT Enterprise Matrix
The importance of timeline analysis and NTP synchronization
Triage / collecting artifacts
Privileged user and group enumeration
Identification of logged accounts
Searching for files at scale
Establishing a baseline for different OS components (cron, at, rc.local, ACLs, hosts, resolv.conf, SELinux, filesystem hashing, packages and checksums)
Process call chains / pstree / process arguments
Collecting and analyzing important process data (/proc)
Finding hidden processes, network connections and kernel modules
Detecting capabilities in ELF, shellcode files
Detecting loaded shared libraries per process
Dropping web shells vs File Integrity Monitoring
Hunting for packers, extracting binary versions and exports
Searching for exploitation attempts in logs
Hunting for Linux rootkits (user space / kernel space)
Hunting for artifacts of process injection techniques
Sysmon Events + Linux Sigma detection rules
Runtime Security Analysis (Falco, Tracee) for host and docker containers
Syscall filtering
Open source ways for memory acquisition and memory forensics
Creating Volatility profiles
Filesystem and Linux process memory yara scans
Linux Endpoint data correlation and hunting for suspicious network events
Network visibility with / without signature rules
Searching for different persistence methods in use
Data correlation and hunting for suspicious network events + RITA
Direct interaction with endpoint: command execution on demand, system modification and active quarantine examples
Hunts enrichment
Using theHive for incident management

Why You Should Take This Course

This course takes on an “attack vs detection” approach in a condensed format. This class is intended for students who have basic understanding of Linux and have to deal with advanced threats. Furthermore, the course is also interesting for experienced DFIR/SOC/CERT players who aim to dig deeper into understanding of Linux internals and corresponding network attack analysis techniques, detection and response.

Who Should Attend

CSIRT / Incident Response Specialists
Red and Blue team members
Penetration testers
Threat Hunters
Security / Data Analytics
IT Security Professionals, Experts & Consultants
SOC Analysts and SIEM Engineers
AI / Machine Learning Developers
Open Source Security Enthusiasts

Prerequisite Knowledge

An intermediate level of command-line syntax experience using Linux.
Fundament knowledge of TCP/IP network protocols.
Penetration testing experience performing enumeration, exploiting, and lateral movement is beneficial, but not required.
Basic programming skills are a plus, but not essential.

Hardware / Software Requirements

This training is based on dedicated PurpleLABS virtual infrastructure so there are no special student’s desktop requirements. No more initial setup issues, just a pure training experience. Every student will gain full access to the PurpleLabs environment for 30 days after the training.
VPN client installed according to VPN Setup instructions or just a browser
Slack account as an invite to dedicated training channel will be sent
Stable internet connection

TRAINER

Leszek Miś

Leszek Miś is the Founder of Defensive Security (www.defensive-security.com), Principal Trainer and Security Researcher with over 16 years of experience in Cyber Security and Open Source Security Solutions market. He went through the full path of the infosec carrier positions: from OSS researcher, Linux administrator, and system developer and DevOps, through penetration tester and security consultant delivering hardening services and training for the biggest players in the European and global market, to become finally an IT Security Architect / SOC Security Analyst with deep non-vendor focus on Network Security attack and detection. He’s got deep knowledge about finding blind spots and security gaps in corporate environments. Perfectly understands technology and business values from delivering structured, automated adversary simulation platform.

Recognized speaker and trainer: BruCON 2017/2018, Black Hat USA 2019, OWASP Appsec US 2018, FloCon USA 2018, Hack In The Box Dubai / Amsterdam / Singapore / Abu Dhabi 2018/2019/2020, 44CON UK 2019, Confidence PL, PLNOG, Open Source Day PL, Secure PL, Advanced Threat Summit PL

Member of OWASP Poland Chapter.

Author of many IT Security trainings:

Open Source Defensive Security → The Trinity of Tactics for Defenders
In & Out → Network Exfiltration and Post-Exploitation Techniques [RED EDITION]
In & Out → Detection of Network Exfiltration and Post-Exploitation Techniques [BLUE EDITION]
System Internals – Network, OS and Memory Forensics
SELinux → Development & Administration of Mandatory Access Control Policy
Advanced RHEL/CentOS Defensive Security & Hardening
ModSecurity → Development and Management of Web Application Firewall rules
FreeIPA → Identity Management for Linux Domain Environments & Trusts

Holds many certifications: OSCP, RHCA, RHCSS, Splunk Certified Architect.

His areas of interest include network “features” extraction, OS internals and forensics. Constantly tries to figure out what the AI/ML Network Security vendors try to sell. In free time he likes to break into “IoT world” just for fun. Still learning hard every single day.

deep knowledge technical trainings

APRIL 17 - 25 @ MOVENPICK AMSTERDAM

Linux Forensics Inspection and Incident Response at Scale (Ams)

Duration

3-day

Delivery Method

Virtual

Level

intermediate

Seats Available

20

REGISTRATION CLOSED

DATE: 17-19 April 2023

TIME: 09:00 to 17:00 CEST/GMT+2

Full access to the PurpleLabs environment for 30 days post-training!

Through the hands-on labs, you will gain a perfect understanding of important DFIR Linux/Network internals and investigation steps needed to get the full picture of post-exploitation activities and artifacts left behind. At scale.

Topics Covered

Why You Should Take This Course

Who Should Attend

CSIRT / Incident Response Specialists

Red and Blue team members

Penetration testers

Threat Hunters

Security / Data Analytics

IT Security Professionals, Experts & Consultants

SOC Analysts and SIEM Engineers

AI / Machine Learning Developers

Open Source Security Enthusiasts

Prerequisite Knowledge

An intermediate level of command-line syntax experience using Linux.

Fundament knowledge of TCP/IP network protocols.

Penetration testing experience performing enumeration, exploiting, and lateral movement is beneficial, but not required.

Basic programming skills are a plus, but not essential.

Hardware / Software Requirements

This training is based on dedicated PurpleLABS virtual infrastructure so there are no special student’s desktop requirements. No more initial setup issues, just a pure training experience. Every student will gain full access to the PurpleLabs environment for 30 days after the training.

VPN client installed according to VPN Setup instructions or just a browser

Slack account as an invite to dedicated training channel will be sent

Stable internet connection

TRAINER

Leszek Miś

SEE YOU IN AMSTERDAM

Interested in being a sponsor or exhibitor? Email us to request for a sponsorship kit!

TITANIUM SPONSOR

COMMSEC TRACK SPONSOR

CTF & CTF PRIZE SPONSOR

SILVER SPONSORS

EXHIBITORS

Copyright 2024 © All rights Reserved. Hack In The Box