Suricata basics

Rule writing basics

Writing rules for HTTP protocol

Writing rules for DNS, TSP and SSL/TLS protocols

Advanced Suricata features

Detecting typical attacks

Problem solving

General cybersecurity concepts

SOC People

SOC Services

• Security monitoring
• SOC use cases
• Threat intelligence
• Threat Hunting

SOC Technologies

• ELK stacks
• SOC tools

SOC development and maturity levels

Lab: WMI consumer hunting

Lab: Linux service hunting

Lab: Domain name hunting

Windows

Windows Credentials and authentication

• SAM and NTDS DIT

Lab: Password credentials in SAM and NTDS

Lab: Password credentials in memory

Lab: Security support providers

User Rights

• Privileges and access control

Lab: Windows Privileges

Lab: Windows services exploitation

• UAC
• Pass the token

Lab: Pass the token and Impersonation

Kerberos

• Kerberoasting
• AS-REP roasting
• Silver ticket
• Golden ticket

Lab: Kerberoasting

Lab: AS-REP roasting

Lab: Silver ticket

Lab: Golden ticket

Windows Security Auditing

Lab: Windows Security Audit

Linux

Linux general information

Linux security

Mandatory access control

Lab: Openssl. Attack Overview

Lab: Openssl. Investigation

Lab: Sudo privilege escalation. Attack Overview

Lab: Sudo privilege escalation. Investigation

Introduction

Foundation of information security. Cyber kill chain. Open-source intelligence.

Incident response process

Incident response process: from preparation to post-incident.

Incident detection: Network & System based

Live analysis on the victim machines with IRCD and PowerShell.

Evidence acquisition

Triage approach. Triage acquisition with Kape, Paladin, FTK-imager and Velociraptor. Applied sessions with FTK imager and Velociraptor.

Memory analysis

Memory forensics with the volatility framework.

Log file analysis

Log file analysis using command line tools up to ELK.

Network analysis

Network IOCs: Dumping network traffic. Network intrusion detection with Suricata. Network analysis tools.

Cyber Threat Intelligence (CTI)

Scanning for Indicators of Compromise (IOC). Host-based IOC scanning with YARA.

Inception

Meet Director of GReAT and ninja master Costin Raiu, your tutor for the course, and get an introduction to Yara syntax along with design tips.

String based rules

Interesting strings and PE structure fields. To hunt down suspicious malware, look for the clues.

Efficient rules

A good Yara rule should be able to hunt out the existence of threats while protecting normal files.

Taking advantage of Yara modules

What happens when threats become more sophisticated? Luckily, Yara has some modules that can be used to your advantage.

Hunting for new samples on VTI

VirusTotal Intelligence (VTI) works natively with Yara. Master these two pieces of software and you might find something that was previously undetected.

Wildcards

Learn about wildcards through exercises featuring the Equation group and Sofacy, some of the most sophisticated cyber espionage groups to have ever existed.

Digital certificates, imphashes and developer footprints

Gets hands-on in the virtual lab with exercises based on WildNeutron, Eye-Pyramid and other famous cases.

Malicious Office documents, OLE format

Find out how you can dump OLE files to identify features that can be then be used for Yara detection.

Expert Yara exercises

Search for suspicious techniques and write effective Yara rules based on the Freaky Shelly case, Lazarus / Bluenoroff and other advanced cases.

YarGen, automation and a bit of magic

Complete your training by finding out how you can use automatic Yara generators, how you can set up a Yara environment within your own organization and how you can hunt threats when you even don’t know what you are looking for.

Introduction

Introduction into IDA work flow and shellcode analysis. Main features of IDA required to reverse engineer: code, functions, structures, structure offsets. Reconstructing the metasploit’s API hashing algorithm.

Shell

Practicing shellcode analysis: extracting the C&C from the Metasploit shell, code and data flow analysis, manual reconstruction of a structure, stack layout.

Msfvenom

Unpacking a real-life sample found at a bank and analyzing the shellcode. Proceeding through all the layers of an msvfenom-wrapped Metasploit shellcode to extract the network IOC.

Bangladesh GPCA

Introduction into static decryption, decrypting files using a static analysis framework. Practice on the Bangladesh CB heist case (Lazarus).

Regin driver

Introduction into decryption of malicious Windows PE files (a Regin driver). Dealing with malicious samples with blocks of encrypted data and RVA/RAW offsets.

Decrypt strings

Static analysis of a Sofacy OSX sample. Dealing with separate strings decrypted with a dedicated function. Reconstructing the decryption routine.

Driver

Full-scale reverse engineering of a single PE file (a driver from Equation). Using knowledge from tracks 1-6 to preprocess all encrypted data and then walk through all the code, reconstructing the business logic of the driver in IDA.

Miniduke

DIY disassembly and API hashing. Creating your own tiny disassembler to extract the API hashes from hand-written assembly code and then reconstructing an API hashing algorithm to revert all the hashes to API names. Using IDC files to transfer results to IDA.

Rocra

Introduction to document-based exploit payloads: analysis of a malicious RTF example (RedOctober dropper) where you need to locate the exploit code, unpack several layers till you get to the final payload. Generic approach to dealing with weaponized RTF documents and embedded shellcode.

Cobalt

Exploit analysis of a malicious Word document (Office Equation exploit). Generic approach to analyzing OLE2 objects.

Cloud Atlas

Practice: analysis of a weaponized OLE2 file embedded in an RTF container (CloudAtlas). Extracting several layers till the final payload.

Miniduke PDF

Static analysis of a ROP chain from a PDF document (with Miniduke from). Generic mechanics of a ROP chain, reconstructing the business logic from code snippets.

Ragua Py2exe

Introduction to bytecode-compiled Python samples. Practice using a decompiler to extract the source code.

Cridex

Generic approach to dynamic decryption/unpacking. Extracting the payloads from Cridex samples using the debugger.

Carbanak

Decompiling and analyzing .NET bytecode. Dynamic extraction of the payload.

Snake

Introduction to the Golang binaries. Static analysis, built-in structures, strings. Extracting and decrypting string constants.

Introduction

Course Introduction. Introduction to the Virtual Lab

Mobile Malware Essentials

Mobile Malware essentials Android. Mobile Malware essentials IOS.

DuKong: Sophisticated Android Espionage Campaign

Introduction To DuKong. Solution: Introduction To DuKong. Stager Functionality. DuKong: Payload Decryption. Solution: Decryption. DuKong Payload Analysis. DuKong: Wrap-up

LightSpy

LightSpy: The Story. Solution: Surface Analysis. LightSpy Unpacking. LightSpy: Wrap-up

MagicKarakurt

MagicKarakurt: The Story. Surface Analysis. Solution: Surface Analysis. Dive Into Native. Dynamic Config Dumping. MagicKarakurt: Wrap-up.

LightSpy iOS

LightSpy iOS: The Story. Solution: Surface Analysis. Code Analysis. LightSpy iOS: Wrap-up. Course Summary.

Introduction and Chafer

Meet your trainers and get to know the course in more depth. Then go in to the Chafer APT to learn more about encryption algorithms (Windows CryptoAPI) and how enumerators and debug data help to understand the code.

LuckyMouse

Combination of static and dynamic analysis: how to use disassembler and debugger in parallel & how to dump decrypted data from memory.

Biodata Exploit

Exploited documents analysis. The tricks in position independent code. Get to know the exploit stages: egg-hunting, decryption, dynamic functions’ address resolution.

Topinambour

Meet interpreted code and understand how it differs from compiled code. Static and dynamic script deobfuscation.

Biodata Trojan

Using IDA Pro’s scripting abilities to automate string decryption.

DeathStalker

How LNK-based infection chains work and how to deobfuscate PowerShell scripts.

MontysThree

Reversing steganography algorithms, importing the custom structure descriptions, exporting embedded encryption keys and scratching the surface of C++.

Lazarus Group

Reverse-engineering x64 malware and reconstructing a custom network protocol from a malware sample.

Cloud Snooper

Reverse-engineering Linux programs including backdoors and rootkits.

Cycldek’s Triad

Reverse-engineering Linux programs including backdoors and rootkits.

Evaluating product security

Introduction to applications and system security; building reliable and resilient ICT infrastructure:

• Approaches for evaluating product security;
• Assessment techniques of a vendor’s software development process;
• Analyzing a vendor’s data processing practices;
• Static and dynamic examination techniques of a software product for its security.

Threat modelling

Introduction to the process of identifying and mitigating potential threats, such as structural vulnerabilities or the absence of appropriate safeguards. The purpose of threat modelling is to provide a systematic analysis of what controls or defenses need to be included, given the nature of the system, the probable attacker’s profile, the most likely attack vectors, and the assets most desired by an attacker.

The sections includes:

• Approaches to threat modeling;
• Actor identification;
• Risk identification;
• Prioritization.

Secure code review

Introduction to basic techniques for identifying vulnerabilities in software code. The purpose of the code review is to ensure that a product has no potential vulnerabilities or backdoors. We will also share best practices of Kaspersky’s Transparency Centers and how processes are organized for external reviews of our source code and software development.

The sections includes:

• Approaches for automated source code analysis;
• Static analysis of source code;
• Dynamic analysis of source code;
• Approaches to manual analysis of source code.

Code fuzzing

This gives an introduction to the process of defining, developing and testing Windows-based applications through fuzzing to identify bugs and vulnerabilities. Though the training focuses on native Windows-based applications, most of the concepts – as well as the methodology and tools – can be applied to other platforms.

After completing this course, trainees will be able to:

• Understand different fuzzing techniques and when to apply them;
• Choose the appropriate tools and prepare a target for fuzzing;
• Generate interesting fuzzing input depending on the target.

Vulnerability management and disclosure

Introduction to and definition of approaches for building the process of managing vulnerabilities within an organization’s ICT infrastructure.

This section includes:

• Sharing best practices for vulnerability management and disclosure;
• Sharing best practice for coordinated vulnerability disclosure;
• Sharing Kaspersky’s experience in handling vulnerability reports from the research community;
• Revealing nuances of bug bounty programs.

Theory

• Introduction to ASM
• The Most Common ASM Instructions
• Correspondence Between C Code And ASM
• Solution: Reading ASM Code. Function calls
• Calling Conventions
• Solution: Understanding a full function. Wrap-up

C-Language 'Hello World'

• Introduction
• The Simplest C Program
• First Steps With IDA
• Working Without Debugging Symbols
• Solution: First Steps With IDA. Windows API
• Solution: Arguments And Constants. Wrap-up

Simple Lambdas

• Starting With Value Fields
• Solution: Value Fields. Adding Pointers
• Solution: Adding Pointer. Shallow And Deep Copying
• Solution: Shallow And Deep Copying. Wrap-up

Stuck In The Heap

• Counting Hash Value
• Solution: Counting Hash Value. Meet The Heap
• Solution: Meet The Heap. Memory Management
• Solution: Memory Management. Wrap-up

Lists And Tricky Pointers

• Servers Chain
• Solution: Servers Chain. List It Till The End
• Solution: List It Till The End. Pointer To The Insides
• Solution: Pointers To The Insides. Wrap-up

C++ And OOP

• Introduction
• Solution: A Simple Class
• Virtual Function Table
• Solution: C++ Inheritance
• The Decompiler
• STL Library: The String Class
• STL Library: The Vector Class. Wrap-up

Pain In The Containers

• Commands As Dictionary
• Solution: Commands As Dictionaries. Real Handlers
• Solution: Real Handlers. Make It Set
• Solution: Make It Set. Wrap-up

Introduction To Golang Reverse-engineering

• Introduction
• Solution: Golang Basics. Debuggers
• Working With x64dbg
• Reconstructing Go Code From The Assembly
• Controlling Execution With Debugger
• Solution: The Decryptor. Go Reverse-engineering methodology

‘Rusty' Code

• Simplest Esoteric Decryptor
• Solution: Simplest Esoteric Decryptor. Vector by reference
• Solution: Vector By Reference. Let’s Be More Rusty
• Solution: Let’s Be More Rusty. Wrap-up

A 'Real' Malware

• Introduction
• Stage 1
• Stage 2
• Stage 3
• Outro. Course summary