Ok let's start with capture filters, explaining the differences between capture filters and display filters and showing you a few power user tricks for managing your data output.  It's about to get REAL.  Let's go!

When I first started learning about Wireshark I had no idea this thing called dissectors even existed!  In this lecture we'll zero our focus on dissectors.  You'll learn what they are, what they do and a little bit of caution you should keep in mind when using them!  Let's start shall we?

Now it's time to make you a bit more comfortable with the Shark!  I'm going to show you how to pet him without getting bit! Let's go!

So you've got your capture going and now you want to see dump captured content... how do you do that?  In this lecture I'm going to show you how to use Wireshark to Export Objects.  And! As an added bonus I'm going to show you how to view objects in another tool called Network Miner!  Let's do this!

Now it's time for the good stuff.  In this lecture we're going to import real malware into our Wireshark lab.  To be more specifically, we're going to perform network forensics on the QakBot banking trojan which dropped a Cobalt Strike beacon payload on patient zero.  Don't worry I'll explain EVERYTHING in this lecture.  We'll start twisting and turn the data in Wireshark, building custom display filters, analyzing network conversations and more!  It's going to be blast guys so let's jump right in!

What! What! More hacks coming at ya.  In this lecture I'm going to show you a TON of practical display filter hacks for maximizing Wireshark productivity.  By the end of this lecture you'll be slicing and dicing your way through packets like a packet connoisseur! Ninja stance ready... let's go!

Oh man, this is the moment you've been waiting for: Profiles.  In this lecture I'll explain what Wireshark profiles are and then I'll walk you through the step-by-step process of tuning and saving custom profiles for specific threat hunting use cases.  It's going to be a ton of fun... oh and as an added bonus: we're going to investigate an incident against a Cobalt Strike malleable C2 beacon masquerading as legit Amazon traffic!  If you don't know what that means, don't worry!  It's about to make sense!  Let's jump right in.

Level up baby!  We are going to continue building out our threat hunting profile in Wireshark.  I'm going to show you how to convert specific hunting related fields to columns (and even advanced tricks such as how to merge columns, you'll see WHY we want to do that in this lecture).  You'll also learn advanced tactics for filtering your data.  Yes, that's right more display filter hacks!  I'll also show you a few handy profile secrets that will make your Wireshark experience a lot more pleasurable!  Are you ready for this like I am? I hope so!  Let's go!!

Now that we have our web hunting profile created let's create a DHCP hunting profile.  Why?  Well DHCP provides a lot of useful data for mapping source IP addresses to hostnames and Layer 2 MAC Addresses.  So in this lecture we'll create and tune our DHCP threat hunting profile and then flip between both the Web and DHCP profiles to show you the speed and agility you can have with this advanced Wireshark tactic!  This is a pretty short video lesson so consider it your chance to get a quick win!

Imagine if you could level up your PCAP analysis by seeing the country, city and ASN information related to a specific source or destination IP? Is there a way to do that?  You could then filter out non-US countries or filter to show only traffic from a specific country and BAM! Your dataset would instantly update helping you quickly find evil in your PCAPs!  You're about to discover the magic of GeoIP baby... and it's awesome.  Let's do this!

Yes! Oh man... okay so now I'm going to show you how to take your Wireshark capabilities to stratospheric heights.  Brim.  Have you heard of this awesome tool?  Wireshark is awesome but when you combine it with the awesomeness of Brim it becomes irresistible.  Come inside this lecture and let me show you the beautiful marriage of Brim and Wireshark!

So one of the things you'll notice when installing Brim is that.... well things are a little weird.  But don't worry I'll walk you through the weirdness in this lecture and quickly get you into the user interface!  Let's go!

So before we just jump right into Brim we need to orient ourselves a little bit!  In this lecture I'll give you a super fast overview of the user interface so we can begin threat hunting in the next lecture! Yes!

Yup - here it is!  We are going deep sea diving into the packets and are about to go swimming with sharks and Brim!  In this lecture I'm going to show you how to pivot to PCAPs, extract Indicators of Compromise, filter results, run threat hunting queries, run statistics on the dataset to quickly find anomalies and more!  This is by far my favorite lecture in the course up until this point!  Let's not waste any more time baby!!

Before we wrapped this section up and get into some Red Teaming fun, I wanted to show you one more tool you might find useful: PacketTotal.  Let's take a quick look and then blast our lab box with some malware so we can study the packets!

Now we are going to compromise our lab user with a spear phishing email, gain code execution with our Covenant C2 grunt payload and then establish a remote C2 channel with the victim (all while capturing the packets!).  Then in the next lecture, we'll feed it into Brim and Wireshark to see what we can learn about the attack and determine the best detection and deterrent methods in case the threat actors strike again!

This is by far my favorite collection of lectures in the entire course because you're going to learn how attackers weaponize Word documents, construct a social engineering pretext and gain initial access into victim environments. And the best part!? Our endpoint is instrumented with Powershell logging and Sysmon!  It's going to be amazing guys!  Let's get started.

We're going to wrap our incident by showing you the advanced capabilities a threat actor has at his disposal with Covenant.  You're going to see how threat actors can use Covenant listener profiles to masquerade their C2 channel as Amazon, Gmail and even MSNBC traffic.  We even going to do some light static code analysis on the Github repository to find detection indicators! Then we're going to see the awe and wonder of Brim as it let's us quickly cut through the packets and extract evil.  I can hardly wait to show you guys!!! Man, let me stop the gushing and just show it off to you all!  LETS GO!