Incident Response

Navigate the rising complexity of cyber security across people, cloud, endpoints, and IoT. Reflect on how evolving threats and data deluge strain security operations and automation.

Understand the core functions of a security operations center, including threat intelligence, threat hunting, log management, threat detection, incident response, and root-cause forensics to reduce the attack surface.

Explore the three-tier soc model where automation handles commodity malware, tier one resolves easier alerts, tier two tackles advanced cases, and tier three conducts proactive threat hunting and forensics.

Demonstrate edr, xdr, siem, and soar within a soc framework, including defender for endpoint and cloud, Sentinel, and Logic Apps for automated incident response.

Blue teams monitor security, response, hunting with edr, xdr, siem, and soar; red teams conduct vulnerability assessments and penetration testing, while purple teaming blends blue with red to boost security.

NIST defines a cyber threat as any event that can adversely impact operations, assets, or individuals through an information system, including unauthorized access, destruction, or denial of service.

Understand the difference between general intelligence, threat intelligence, and cyber threat intelligence, focusing on adversaries, threats, and the cyber-specific tactics, techniques, and procedures they use.

Cyber threat intelligence is knowledge about adversaries’ motivations, intentions, and methods, collected and analyzed to protect enterprise assets. It focuses on behavior, tactics, techniques, and procedures to enable threat-informed defense.

Define and distinguish threats, vulnerabilities, and risks, and show how threat actors exploit vulnerabilities to cause downtime or data integrity breaches, with risk as the combination of impact and likelihood.

Explain threat informed defense by defining your organization's mission, identifying target threat actors and their motivations, and mapping ttps to enhance detection, protection, and threat hunting in your SoC.

Define tactics, techniques, and procedures as a hierarchy from high-level threat objectives to detailed, step-by-step actions. Compare how techniques realize tactics and how procedures reveal sub-techniques and tools.

Differentiate IOCs from IOAs; learn how file hashes and domains indicate breaches, while IOAs reveal attacker intent and behavior for threat-informed defense.

The pyramid of pain ranks indicators by how hard attackers must change them, from hashes and ip addresses to tools, emphasizing detection of tactics, techniques, and procedures to hinder breaches.

Identify CTI sources in three areas—enterprise tools (paid), Osint (free offerings), and social media—featuring Microsoft Defender Threat Intelligence, VirusTotal, Shodan, and X, LinkedIn, and Medium insights.

Discover how on demand self service, rapid elasticity, resource pooling, measured service, and prod network access enable scalable, pay-per-use cloud computing.

Define public, private, hybrid, and multi-cloud types with examples from Azure, AWS, and GCP, and show how enterprises combine Azure Stack, AWS Outposts, and Google Anthos.

Explore how the Azure global backbone connects data centers worldwide through fiber, subsea cables, edge sites, network partners, and peering connections to boost performance, fault tolerance, and disaster recovery.

Explore the shared responsibility model across on-premises to cloud (IaaS, PaaS, SaaS) in Azure, highlighting what customers versus Microsoft must manage, including security implications.

Organize azure resources with management groups, subscriptions, and resource groups, clustering resources by lifecycle or criteria like region or department, and understand their roles in billing and governance.

Explore Azure subscription types for demos, including free and student options with time-limited credits, and pay as you go or enterprise agreements with negotiable discounts.

Clarify how the intra ID tenant and its identities access Azure resources in subscriptions and resource groups, debunking the idea that subscriptions are tenants.

Define zero trust as a security strategy and mindset, not a product. Verify explicitly, enforce just-in-time least-privilege access, and assume breach to minimize blast radius.

Explore Microsoft security cosmos, focusing on cloud security, SOC, threat intelligence, with Defender for identity, endpoint, cloud apps, and Defender for cloud, plus Microsoft Sentinel and Copilot for security.

Explore a classic cyber kill chain and defend it with Microsoft security products, from phishing and exploits to data exfiltration, using Defender for Office and Defender for Endpoint.

Learn the NIST incident response process, a four-step framework of preparation, detection and analysis, containment, eradication and recovery, and post-incident activity or lessons learned, with iterative preparation for future incidents.

Tailor the preparation phase of the NIST incident response process by establishing policies, training staff and security personnel, securing tooling, and pre-planning communications; regularly test through tabletop exercises.

Detect and analyze security incidents using SIEM, IDS, antivirus, and EDR; apply log analysis, forensics, and root cause analysis; use playbooks to determine scope, impact, and triage with threat intelligence.

Apply short-term and long-term containment to isolate threats and disable affected accounts, eradicate malware and patch vulnerabilities, then restore from clean backups and monitor post-recovery for signs of compromise.

Identify lessons learned from post incident reviews to refine the incident response plan and procedures, report findings to stakeholders, and monitor metrics like mean time to respond to continually improve.

Explore the seven-step SANS incident response process, compare it with NIST, and examine the preparation, identification, containment, eradication, recovery, and lessons learned phases.

Develop an incident response plan and cross-functional team, unite IT, security, legal, public relations, and HR, and implement training, tools maintenance, and clear internal and external communication guidelines.

Identify anomalies with security tooling, triage alerts, and record initial findings; apply forensic techniques with chain of custody to preserve data integrity and inform stakeholders per guidelines.

Outline short term and long term containment strategies per NIST, with plans to remediate systems quickly or over time. Secure evidence, review containment efficacy, and keep stakeholders informed.

Eradication phase focuses on removing root causes, cleaning affected systems, validating integrity, and updating defenses to prevent recurrence, while documenting actions for future prevention and compliance.

Restore systems to full function and security during the recovery phase, monitor post-recovery for lingering issues, and reassess risk posture while returning operations and informing stakeholders.

Conduct a post-incident review to assess actions, improve policies and trainings, and share findings with all stakeholders for a continuous, robust incident response.

The LM cyber kill chain outlines how adversaries progress through reconnaissance, weaponization, delivery, exploitation, installation, C2, and actions on objective, guiding incident response and prevention efforts.

Explore the reconnaissance phase of the cyber kill chain as adversaries gather information, monitor data leakage, and leverage osint and social engineering to target public assets.

Learn how incident responders counter weaponization by recognizing malware types—ransomware, trojans, viruses—and exploit kits, and by applying rapid vulnerability assessment and patch management; implement application whitelisting and EDR/XDR.

Discover the delivery step of the cyber kill chain, covering phishing, drive-by downloads, and remote exploitation, with defensive tools like EDR and firewall logs.

Explore exploitation phase of the cyber kill chain, where malware exploits a vulnerability. Recognize signs like unexpected behavior or crashes, and support rapid containment with patch management.

Identify malware persistence during installation, including registry keys, startup items, DLLs, rootkits, and containers, then execute eradication, recovery, post-restoration monitoring, and patch management with EDR/XDR.

Identify C2 traffic patterns where compromised systems connect to a remote infrastructure for directions. Note dns port 53 as a common C2 channel and encrypted channels and non-standard ports.

Explore actions on objectives in the cyber kill chain, detailing attacker goals like data theft and ransom demands, and countermeasures such as damage assessment, business continuity, backups.

Delve into the Mediatheque framework, built on adversarial tactics and techniques, to enable threat-informed defense and explore using the Miter attack framework in Sentinel to gauge coverage via the matrix.

Map the pyramid of pain to ATT&CK framework by aligning tactics, techniques, and sub techniques, noting artifacts like hash values, IP addresses, and domains are not the focus in CTI.

Examine the three big matrices—enterprise, mobile, and ICS—along with submatrices for Windows, Linux, Mac OS, Azure AD (intra ID), 365, Google Workspaces, networks, and containers.

Explore the Mitre attack framework's 14 tactics, detailing the why and behavior behind adversary objectives from reconnaissance to impact.

Explore how attackers execute attacks by examining 201 techniques across tactics—from reconnaissance with active scanning to data destruction, including phishing, persistence, masquerading, and encrypted C2 channels.

Explore the 424 sub techniques in incident response and how adversaries implement attacks, with examples like vulnerability scanning, phishing, malware, DLL injection, RDP, password spraying, and asymmetric cryptography for exfiltration.

Explore how tactics explain adversaries' motives within the attack framework, and how techniques and sub techniques detail execution methods, such as the command and scripting interpreter and Python.

Identify and onboard data sources to collect telemetry and detect adversaries, focusing on network traffic and logs for vulnerability scanning within the MITRE ATT&CK framework.

This lecture defines detections in incident response, highlighting reconnaissance, active scanning, and vulnerability scanning, and demonstrates detecting them via web application firewall logs and CIM alerts.

Explore mitigations as preventative configurations and pre-compromise measures to reduce the attack surface and limit reliance on detection. Establish privileged account management for scheduled task risks in Active Directory.

Explain how threat groups are named differently by vendors, showing Apt41 as a common example, and compare naming conventions used by Mandiant, CrowdStrike, and Microsoft.

Explore software as the tools and malware adversaries use within the Mida framework, and how it ties to techniques, groups, and campaigns, including built-in or publicly available software like PowerShell.

Campaigns are coordinated intrusion operations over a period with common targets and objectives, not every breach qualifies as a campaign, as seen in Sandworm's Ukraine grid attack and Maccabees.

You will learn how mitre attack terms—groups, tactics, objectives, motivations, techniques and sub-techniques—interrelate and how campaigns form from structured use; defenders use data sources to build detections.

Demonstrate the MITRE ATT&CK enterprise matrix in a live browser demo, detailing tactics, techniques, sub-techniques, data sources, mitigations, and detections.

Watch the attack evolve as a constantly changing framework updated roughly every six months with the latest techniques and sub techniques seen by the intelligence community.

Explore the MITRE defend framework, a defender-focused knowledge graph of adversary tactics and techniques, funded by the NSA, to help security professionals categorize and defend against real-world TTPs.

Map d3fend to the pyramid of pain by prioritizing defense against adversary tps over iocs, adopting a defender mindset and threat-focused protection.

Map tactics and techniques from D3FEND to the CDI model, and understand why defend uses subclasses instead of sub techniques for procedures.

Explore the defend tactics and how they compare to attack, detailing seven tactics: model, harden, detect, isolate, deceive, evict, restore, to improve security.

Examine defense techniques and attack countermeasures, including application hardening, pointer and stack validation, network mapping, network isolation, decoy environments, and restoring compromised systems.

Explore defend's subclasses, the lowest level of tactics, techniques, and procedures, including homoglyph detection and reputation analysis that match IOCs to network traffic.

Explore artifacts used in defense through a knowledge graph that links files, URLs, and file sections, showing how create file artifact and delete file actions interact to help defenders.

Explore the MITRE D3FEND matrix with its tactics, techniques, subclasses, artifacts, taxonomies, and knowledge graph, and learn to map defend to attack for a SOC-focused defense.