Instructor: Chris Brenton
Course Length: 16 Hours
Includes: 12 months of complimentary access to the Antisyphon Cyber Range, certificate of participation, six months access to class recordings.
So far we’ve had over 21,000 students attend our one-day network threat hunting course. Many have asked that we provide an extended class with more hands-on lab time. That is exactly what we have rolled into this 16-hour course!
We will spend most of this class analyzing PCAP files for Command and Control (C2) communications in order to identify malware back channels. It is assumed that the student will already understand the basics of network threat hunting, so we can immediately jump into applying that knowledge. The goal will be to create a threat hunting runbook that you can use within your own organization in order to identify systems that have been compromised.
Key Takeaways
- Identify tools and processes for network threat hunting
- How to set up a threat hunting environment
- Threat score system to prioritize artifacts
- Leveraging network findings to pivot into a forensic analysis
Audience Skill Level
Students should have a working understanding of IP communications. They should also have a basic understanding of network threat hunting. It is highly recommended that you attend our free one-day threat hunting course prior to taking this class. This class builds on the content of that one-day course.
System Requirements
- Access to an Ubuntu 16.04 LTS system
- Four cores, 16 GB RAM, 50 GB of free storage under the /home directory
- Ubuntu system can be a dedicated system, VM or public cloud IaaS server
Internet access
- The ability to connect to the Ubuntu system via SSH
- A system capable of participating in the video conference
What Each Student Should Bring
A desire to learn and lots of questions!
What Students Will Be Provided With
- Slide deck
- VMs with all labs
- 12 months Cyber Range access
Trainer & Author
Chris Brenton, COO of Active Countermeasures, has been a leader in the IT and security industry for over 20 years. He’s a published author of multiple security books and the primary author of the Cloud Security Alliance’s online training material. As a Fellow Instructor, Chris developed and delivered multiple courses for the SANS Institute. As an alumni of Y-Combinator, Chris has assisted multiple startups, helping them to improve their product security through continuous development, and identifying their product-market fit.
Live Training Events
This class will be taught as part of
the Antisyphon Most Offensive Con that Ever Offensived! Summit,
March 1-3, 2023.