Advanced Network Threat Hunting w/ Chris Brenton

Instructor: Chris Brenton
Course Length: 16-Hour

Includes: 12 months of complimentary access to the Antisyphon Cyber Range, certificate of participation, six months access to class recordings.

So far we’ve had over 12,000 students attend our one-day network threat hunting course. Many have asked that we provide an extended class with more hands-on lab time. That is exactly what we have rolled into this 16-hour course!

We will spend most of this class analyzing pcap files for Command and Control (C2) communications in order to identify malware back channels. It is assumed that the student will already understand the basics of network threat hunting, so we can immediately jump into applying that knowledge. The goal will be to create a threat hunting runbook that you can use within your own organization in order to identify systems that have been compromised.

KEY TAKEAWAYS

• Identify tools and processes for network threat hunting
• How to set up a threat hunting environment
• Threat score system to prioritize artifacts
• Leveraging network findings to pivot into a forensic analysis

WHO SHOULD TAKE THIS COURSE

• Security analysts looking to hone their threat hunting skills
• Junior analysts looking to forward their security career
• Environments needing to quickly identify compromised systems
• Analysts needing to protect IoT and IIoT environment

AUDIENCE SKILL LEVEL

Students should have a working understanding of IP communications. They should also have a basic understanding of network threat hunting. It is highly recommended that you attend our free one-day threat hunting course prior to taking this class. This class builds on the content of that one-day course.

STUDENT REQUIREMENTS

• Access to an Ubuntu 16.04 LTS system
• Four cores, 16 GB RAM, 50 GB of free storage under the /home directory
• Ubuntu system can be a dedicated system, VM or public cloud IaaS server
• Internet access
• The ability to connect to the Ubuntu system via SSH
• A system capable of participating in the video conference

WHAT EACH STUDENT SHOULD BRING

A desire to learn and lots of questions!

WHAT STUDENTS WILL BE PROVIDED WITH

• Slide deck
• VMs with all labs
• 6 months Cyber Range access

TRAINER & AUTHOR

Chris, COO of Active Countermeasures, has been a leader in the IT and security industry for over 20 years. He’s a published author of multiple security books and the primary author of the Cloud Security Alliance’s online training material. As a Fellow Instructor, Chris developed and delivered multiple courses for the SANS Institute. As an alumni of Y-Combinator, Chris has assisted multiple startups, helping them to improve their product security through continuous development, and identifying their product-market fit.

COURSE SCHEDULE