Detection Engineering Masterclass: Part 1

Explore how security operations connect threat intelligence, threat hunting, and incident response. Learn detection engineering to create custom alerts, unit tests, vendor-based alerts, and cross-team feedback.

Explore role variety across small, medium, and large businesses, from security operations to incident response, threat intelligence, and hunting, and how detection engineering fits within different teams and socs.

Discover how security incident and event management systems, or SIMs, act as log aggregators with analytics, enabling alerting, dashboards, querying, and case management for incident response and threat hunting.

Explore the detection engineering workflow, from input sources and processing to outputs for incident response, including unit testing, alert development, and documentation.

Identify what makes a good detection by examining response feedback, false positives and fidelity, timeliness, specificity, testability, unit testing, compensating controls, documentation, and peer review.

Learn the technology stack for detection engineering, from log querying and siems to alert development, unit testing, and documentation, plus ci/cd pipelines for validated detections.

Explore the MITRE ATT&CK framework, detailing tactics, techniques, sub-techniques, and IDs to standardize threat discussion. Trace how phishing and PowerShell illustrate attack chains and improve detection coverage.

Explore the MITRE enterprise ATT&CK matrix, reading tactics and techniques (PowerShell) and using the attack navigator to build, color-code, and export detection layers as json for ransomware scenarios.

Set up a lab with VirtualBox host-only networking, three VMs (Ubuntu with Zeke, Windows 11 as the victim, and Parrot OS as the attacker), and Elastic logging via agents.

Create a well-organized course folder and download all lab assets for detection engineering in VirtualBox, including Ubuntu 22.04.2 LTS, Parrot Security, Kali, and Windows 11 development environment.

Import ParrotOS as a virtual machine in VirtualBox, configure a host-only network for isolated testing, boot, update the OS, and note the host-only IP address for targeted testing.

Set up a Windows 11 VM in VirtualBox, optimize storage on SSDs, allocate CPU and RAM, import the appliance, configure a host-only network, and verify connectivity with Cmd.exe.

Install ubuntu in virtualbox by performing a full os installation with unattended install, configuring host-only networking and promiscuous mode, and enabling guest additions for dynamic resizing, then verify connectivity.

Master VirtualBox VM snapshots for baselining and quick rollback in a home lab; compare snapshots with clones and learn quick restore.

Learn to disable Windows Defender for lab use, covering tamper protection, virus and threat protection settings, and turning off real-time protection through group policy.

Install Zeek on Ubuntu via official quickstart, including curl and repository setup. Configure the interface and monitor the private IP space, then start and manage Zeek with its control tool.

Explore Elastic's analytics and security modules to build detection engineering skills, using Discover, dashboards, case management, alerts, and incident analysis with sample data and API keys.

Sign up for the elastic cloud trial, start a two-week free deployment, log in, and begin rolling out agents while saving access data with a password manager.

Extend a trial in elastic cloud or restart with a new trial using a fresh email alias. Uninstall old agents and install updated ones to ensure the integrations work smoothly.

Install the elastic agent and elastic defend integration to collect logs and detect threats, then enable detection-only malware and ransomware policies and output json logs.

Verify Zeek logging with an Nmap port scan and view real-time logs in Elastic. Learn to troubleshoot ingestion, explore the Zeek dashboard, and filter reconnection logs.

Test Windows 11 logging with an EICAR file to validate Elastic Defend detections, explore Elastic Agent logs, process execution, and PowerShell activity for detection engineering.

Sysmon on windows enhances logging by feeding richer data into elastic and the elastic agent, working in tandem via a configurable, out-of-the-box swift on security setup.

Install and configure sysmon on Windows 11, download the xml config from Swift on Security, place it with sysmon, and apply an Elastic agent policy for log collection.

Test and compare Sysmon and Elastic agent logging using the EICAR file and PowerShell commands, examining process execution, file creation, and command-line visibility.

Enable module logging, scriptblock logging, and partial transcription via the local group policy editor to improve PowerShell visibility. Verify logs in Elasticsearch from elastic agent and PowerShell sources.

Explore a basic detection engineering attack scenario using a simple Python web server on a Windows VM, scanned by Nmap, Nikto, and ZAP, with detections logged into Elastic.

Set up the attack environment by deploying Zeek, launching a Windows web server, and generating test files. Analyze Zeek and elastic logs to tailor views for alert creation and detections.

Run nmap, nikto, and zap against the web server on port 8000, assess open http service and python http server clues, then review zap alerts and plan detections in Elastic.

Create your Elastic detection by building a custom query alert from Zeek http data, focusing on nicto and nmap user agent strings and port scanning, with suppression and discovery mapping.

Create a threshold alert that triggers on abnormally large http traffic by counting activity over a defined threshold, grouping by source and destination IP, with checks every five minutes.

Learn to test and validate detection engineering alerts using Elastic, covering web scanner detections from Nmap and Neato, alert suppression, and threshold alerts.

Execute a staged attack with an initial dropper to detect defender status, download the return shell only when defender is disabled, and validate detections in Elastic logs.

Explore how to craft and execute a malware dropper using batch and PowerShell on a Windows 11 VM, including checking Windows Defender status to conditionally run code.

Demonstrate weaponizing a proof-of-concept attack using PowerShell, MSF Venom, and Metasploit to deliver a reverse shell, then discuss detection and defenses.

Analyze simulated attack data to craft network and endpoint detections, including bat files, PowerShell, and msf venom payload, using elastic logs and alerting strategies.

Create four detections and alerts to flag bat files in http traffic on unusual ports, PowerShell executions, invoke web request downloads, and Venom's PowerShell return shell.

Run a quick test to confirm detections and observe alerts in elastic, including bat file execution, obfuscation, and suppression rules that limit duplicates.

Launches a dropper to download key logger scripts, adds them to the registry currentversion run, collects keystrokes and system data, then zips and exfiltrates via ftp with four alerts.

Staging our attack introduces key logger testing, browser history analysis, and data exfiltration workflows, including an FTP-based transfer and PowerShell-based proofs of concept.

Learn to create and execute a dropper that deploys a keylogger and Excel scripts, register startup entries, collect system information and history, and prepare data for transfer.

Build and tune detections in Elastic to flag registry run keys, PS1 and PowerShell activity, temp file writes, zip data staging, and FTP exfiltration, mapping to persistence and discovery techniques.

Rebooted the Windows 11 machine, sent logs to Elastic, and verified four alerts—dropper, keylogger, Excel script, and data exfiltration via FTP—triggered as expected.

Explore how Atomic Red Team serves as a free attack framework to test logs, alerts, and detections, and how to use it for unit testing and incident response.

Install Atomic Red Team with the Invoke Atomic framework on Windows 11, choosing to download the repo or run atomics via the framework.

Run the first atomic test from the Atomic Red Team on a Windows VM to capture audio, exploring PowerShell and registry activity, and verify results in Elastic logs.

Learn to write your first atomic test in the atomic red team framework by adapting a dropper from an attack scenario, running tests, and forking to manage custom additions.