Course

Hands-on first look at some of the tools, techniques, and procedures used for network-based and Windows forensics as it pertains to threat hunting. Attacks by basic to advanced threat actors will leave artifacts that can be detected. Study collecting and correlating current and historic pcap-based network data with host and network generated logs to create a profile of an attack for post-incident investigations and reporting or proactive threat hunting. Go further into forensics with examining end point data by investigating Windows and browser artefacts that track user actions. Open-source tools include: Security Onion [Hunt, Kibana, Playbook, Cyber Chef, Network Miner, Wireshark, etc.