Udemy
    •  
    •  
    •  
    •  
    •  
    •  
    •  
    •  
Subscribe
Turn what you know into an opportunity and reach millions around the world.
Learn More
Your cart is empty.
Keep shopping
SDF: Persistence Fast Triage
Rating: 4.8 out of 5(13 ratings)
86 students
Created byMichael Leclair
Last updated 12/2022
English

What you'll learn

  • Learn how to triage Windows systems for evidence of compromise quickly
  • Learn about key artifacts used for targeted persistence analysis
  • Learn Splunk logic for fast triage
  • Learn by doing - practical exercises - basic python with some powershell
  • Learn by doing - practical exercises - convert EVTX files to CSV with open-source tools

Course content

15 sections • 66 lectures • 2h 50m total length

  • Intro & About Fast Triage4:24

    Welcome to the Persistence Fast Triage course for Windows! This module outlines the forensic value of the fast triage methodology.

  • About the Series1:48

    Persistence fast triage is one of several classes part of the fast triage training series. Use the courses individually or as a whole to build up your own response program. Each module provides artifact details along with the triage approach.

  • About the Modules4:44

    The class does not promote any one specific tool. Tools are necessary to process the event log data for analysis. Many SIEMS include this capability along with open-source options such as Elk-Stack (SOF-ELK) and Chainsaw. Splunk is used for demonstration purposes only.

Requirements

  • Understanding of basic Windows security\ forensics
  • Understanding of the concept of a SIEM
  • Understanding of security incident response process\ goals
  • Basic understanding of CMD commands\ powershell commands\ python
  • Windows test system

Description

Research conducted on malicious campaigns found the successful establishment of a persistence mechanism(s) necessary for the attacker to achieve their goals. Installing persistence is a choke point in the attack method and provides an opportunity for detection through the analysis of affected system artifacts.

The identification of a compromised system is a high priority. Discovering the compromise early during an investigation improves scoping, containment, mitigation, and remediation efforts. If persistence is not detected, it may reduce the perceived risk of the system. Either finding is valuable for making resource assignment decisions.

This class teaches you how to utilize readily available artifacts to uncover persistence mechanisms quickly. Each module breaks down the artifact from a DFIR point of view, identifying key elements and analysis strategy guidelines along the way. Just about any forensic platform or security appliance may be used once you understand how to approach the artifact. Splunk is used to provide SIEM logic examples. Open-source tools, with a little python scripting, is used for the practical exercises. The completed python scripts are provided as well.

The main artifact categories covers evidence that appears in investigations repeatedly:

  • Windows event logs for services

  • Windows event logs for scheduled tasks

  • Windows registry autoruns and registry modification events.


Who this course is for:

  • New security incident response analysts
  • New SOC analysts
  • New threat hunters
  • Students
  • DFIR professionals

Report abuse