Security Event Triage: Monitoring Network Application Services

سرفصل های دوره

Exploited network application services allow a malicious actor to establish covert channels and silently exfiltrate data. This course will show you how to use the service logs to quickly detect these attacks and closedown the open threat vectors.

Exercise Files

set-monitoring-network-application-services.zip

Module 1 - Course Overview

1. Course Overview

Module 2 - Increasing the Digital Forensic Footprint with Log Data

1. Module Overview

2. Defining Network Application Services

3. Filling Out the Big Picture with Log Data

4. Setting up a Lab Environment

5. Log Analysis with Sigma

6. Module Summary

Module 3 - Detecting DNS Tunneling

01. Module Overview

02. Establishing a Covert Channel Over DNS

03. Understanding DNS Covert Channels

04. Sigma Rules for DNS C2 Attacks

05. BIND DNS Channel Detection with Postman

06. Analyzing BIND DNS with JupyterLab

07. Using Windows Events for DNS Monitoring

08. Visualizing the C2 Channel

09. Identifying the Compromised Clients

10. Module Summary

Module 4 - Identifying Compromised Authentication Application Protocols

1. Module Overview

2. Remote Services and Threat Vectors

3. Threat Finding with DeepBlueCLI

4. Analyzing Windows Logon Events

5. Creating a Timeline for the Attack

6. Enumerating SSH Users

7. Securing SSH with Keys

8. Module Summary

Module 5 - Exfiltrating Data with FTP and SMTP

1. Module Overview

2. Understanding the Role of FTP

3. Examining the FTP Logs

4. Investigating FTP Anonymous File Access

5. Monitoring the SMTP Relay

6. Understanding SMTP Log Entries

7. Module Summary

Module 6 - Finding Rogue DHCP Servers and VPN Weaknesses

1. Module Overview

2. Understanding DHCP Attack Techniques

3. Investigating DHCP Server Exploits

4. Locating Rogue DHCP Servers

5. Safeguarding Your VPN Services

6. Examining the OpenVPN Service

7. Analyzing OpenVPN with AWS CloudWatch

8. Summary

139,000 تومان

خرید اشتراک افزودن به سبد خرید

خرید دانلودی فوری

در این روش نیاز به افزودن محصول به سبد خرید و تکمیل اطلاعات نیست و شما پس از وارد کردن ایمیل خود و طی کردن مراحل پرداخت لینک های دریافت محصولات را در ایمیل خود دریافت خواهید کرد.

تولید کننده: PluralSight