What You Will Learn
ADVANCED THREATS ARE IN YOUR NETWORK - IT'S TIME TO GO HUNTING!
FOR508: Advanced Incident Response and Threat Hunting Course will help you to:
- Detect how and when a breach occurred
- Identify compromised and affected systems
- Perform damage assessments and determine what was stolen or changed
- Contain and remediate incidents
- Develop key sources of threat intelligence
- Hunt down additional breaches using knowledge of the adversary
DAY 0: A 3-letter government agency contacts you to say an advanced threat group is targeting organizations like yours, and that your organization is likely a target. They won't tell how they know, but they suspect that there are already several breached systems within your enterprise. An advanced persistent threat, aka an APT, is likely involved. This is the most sophisticated threat that you are likely to face in your efforts to defend your systems and data, and these adversaries may have been actively rummaging through your network undetected for months or even years.
This is a hypothetical situation, but the chances are very high that hidden threats already exist inside your organization's networks. Organizations can't afford to believe that their security measures are perfect and impenetrable, no matter how thorough their security precautions might be. Prevention systems alone are insufficient to counter focused human adversaries who know how to get around most security and monitoring tools.
The key is to constantly look for attacks that get past security systems, and to catch intrusions in progress, rather than after attackers have completed their objectives and done significant damage to the organization. For the incident responder, this process is known as "threat hunting". Threat hunting uses known adversary behaviors to proactively examine the network and endpoints in order to identify new data breaches.
Threat hunting and Incident response tactics and procedures have evolved rapidly over the past several years. Your team can no longer afford to use antiquated incident response and threat hunting techniques that fail to properly identify compromised systems, provide ineffective containment of the breach, and ultimately fail to rapidly remediate the incident. Incident response and threat hunting teams are the keys to identifying and observing malware indicators and patterns of activity in order to generate accurate threat intelligence that can be used to detect current and future intrusions.
Syllabus (36 CPEs)Download PDF
There are ways to gain an advantage against the adversaries targeting you -- it starts with the right mindset and knowing what works.
Incident responders and threat hunters should be armed with the latest tools, memory analysis techniques, and enterprise methodologies to identify, track, and contain advanced adversaries and to remediate incidents. Incident response and threat hunting analysts must be able to scale their analysis across thousands of systems in their enterprise. This section examines the six-step incident response methodology as it applies to incident response for advanced threat groups. We will show the importance of developing cyber threat intelligence to impact the adversaries' "kill chain". We will also demonstrate live response techniques and tactics that can be applied to a single system and across the entire enterprise.
Endpoint detection and response (EDR) capabilities are increasingly a requirement to track targeted attacks by an APT group or organized crime syndicates that can rapidly propagate through hundreds of systems. Rapid response to multiple distributed systems cannot be accomplished using the standard "pull the hard drive" forensic examination methodology. Such an approach will alert the adversaries that you are aware of them and may allow them to adapt quickly and exfiltrate sensitive information in response.
Students will receive a full six-month license of F-Response Enterprise Edition, enabling them to use their workstation or the SIFT workstation to connect and script actions on hundreds or thousands of systems in the enterprise. This capability is used to benchmark, facilitate, and demonstrate new incident response and threat hunting technologies that enable a responder to look for indicators of compromise across the entire enterprise network.
- SIFT Workstation orientation
- Access to remote endpoint data collection
- Defense evasion techniques - Malware defense evasion and detection
- Understanding core Windows processes
- Persistence - Malware persistence detection and analysis
- Finding and Analyzing Malicious WMI Event Consumers
- Real Incident Response Tactics
- Preparation: Key tools, techniques, and procedures that an incident response team needs to respond properly to intrusions
- Identification/Scoping: Proper scoping of an incident and detecting all compromised systems in the enterprise
- Containment/Intelligence Development: Restricting access, monitoring, and learning about the adversary in order to develop threat intelligence
- Eradication/Remediation: Determining and executing key steps that must be taken to help stop the current incident
- Recovery: Recording of the threat intelligence to be used in the event of a similar adversary returning to the enterprise
- Avoiding "Whack-A-Mole" Incident Response: Going beyond immediate eradication without proper incident scoping/containment
- Threat Hunting
- Hunting versus Reactive Response
- Intelligence-Driven Incident Response
- Building a Continuous Incident Response/Threat Hunting Capability
- Forensic Analysis versus Threat Hunting across endpoints
- Threat Hunt Team Roles
- ATT&CK - MITRE's Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK(TM))
- Threat Hunting in the Enterprise
- Identification of Compromised Systems
- Finding Active and Dormant Malware
- Digitally Signed Malware
- Malware Characteristics
- Common Hiding Mechanisms
- Finding Evil by Understanding Normal
- Understanding Common Windows Services and Processes
- svchost.exe Abuse
- Incident Response and Hunting across Endpoints
- WMIC & PowerShell
- Incident Response and Hunting Endpoint Collection with Kansa
- Malware Defense Evasion and Identification
- Service Hijacking/Replacement
- Frequent Compilation
- Binary Padding
- Dormant Malware
- Signing Code with Valid Cert
- Malware Persistence Identification
- AutoStart Locations, RunKeys
- Service Creation/Replacement
- Service Failure Recovery
- Scheduled Tasks
- DLL Hijacking
- WMI Event Consumers
- More Advanced - Local Group Policy, MS Office Add-In, or BIOS Flashing
- Investigating WMI-Based Attacks
- WMI Overview
- WMI Attacks Across the Kill Chain
- Auditing the WMI Repository
- WMI File System and Registry Residue
- Command-Line Analysis and WMI Logs
- WMI Process Anomalies
--Even the most advanced adversaries leave footprints everywhere. Learn the secrets of the best hunters.
Cyber defenders have a wide variety of tools and artifacts available to identify, hunt, and track adversary activity in a network. Each attacker action leaves a corresponding artifact, and understanding what is left behind as footprints can be critical to both red and blue team members. Attacks follow a predictable pattern, and we focus our detective efforts on immutable portions of that pattern. As an example, at some point an attacker will need to run code to accomplish its objectives. We can identify this activity via application execution artifacts. The attacker will also need one or more accounts to run code. Consequently, account auditing is a powerful means of identifying malicious actions. An attacker also needs a means to move throughout the network, so we look for artifacts left by the relatively small number of ways there are to accomplish this part of their mission. In this section, we cover common attacker tradecraft and discuss the various data sources and forensic tools you can use to identify malicious activity in the enterprise.
- Hunting and detecting evidence of execution with Shimcache and Amcache
- Prefetch carving and extraction from memory and unallocated space
- Discovering credential abuse with event log extraction and analysis
- Tracking lateral movement with event log analysis
- Hunting malicious use of WMI and PowerShell
- Stealing and Utilization of Legitimate Credentials
- Pass the Hash
- Single Sign On (SSO) Dumping using Mimikatz
- Token Stealing
- Cached Credentials
- LSA Secrets
- Kerberos Attacks
- NTDS.DIT theft
- Advanced Evidence of Execution Detection
- Attacker Tactics, Techniques, and Procedures (TTPs) overserved through process execution
- Prefetch Recovery and Analysis
- Application Compatibility Cache (ShimCache)
- Amcache Registry Examination
- Lateral Movement Adversary Tactics, Techniques, and Procedures (TTPs)
- Compromising Credentials Techniques
- Remote Desktop Services Misuse
- Windows Admin Share Abuse
- PsExec Utilization
- Windows Remote Management Tool Techniques
- PowerShell Remoting/WMIC Hacking
- Vulnerability Exploitation
- Log Analysis for Incident Responders and Hunters
- Profiling Account Usage and Logons
- Tracking and Hunting Lateral Movement
- Identifying Suspicious Services
- Detecting Rogue Application Installation
- Finding Malware Execution and Process Tracking
- Capturing Command Lines and Scripts
- Powershell Transcript and ScriptBlock Logging
- PowerShell Script Obfuscation
- WMI Activity Logging
- Anti-Forensics and Event Log Clearing
During an intrusion, using memory analysis sometimes feels like cheating - finding active attacks shouldn't be this easy.
Now a critical component of many incident response and threat hunting teams who regularly detect advanced adversaries in their organization, memory forensics has come a long way in just a few years. Memory forensics can be extraordinarily effective at finding evidence of worms, rootkits, PowerShell, and advanced malware used by APT attackers. In fact, some attacks may be nearly impossible to unravel without memory analysis. Memory analysis was traditionally the domain of Windows internals experts, but the recent development of new tools and techniques makes it accessible today to all investigators, incident responders, and threat hunters. Better tools, interfaces and detection heuristics have greatly leveled the playing field. Understanding attack patterns in memory is a core analyst skill applicable across a wide range of endpoint detection and response (EDR) products. This extremely popular section will cover many of the most powerful memory analysis capabilities available and give you a solid foundation of advanced memory forensic skills to super-charge investigations, regardless of the toolset employed.
- Remote endpoint incident response, hunting, and analysis using F-Response Enterprise
- Remote endpoint memory examination using F-Response Enterprise
- Creating triage images with KAPE
- Detect unknown live and dormant custom malware in memory across multiple systems in an enterprise environment
- Examine Windows process trees to identify normal versus anomalies
- Find APT "beacon" malware over common ports used by targeted attackers to access command and control (C2) channels
- Find residual attacker command-line activity through scanning strings in memory and by extracting command history buffers
- Compare compromised system memory against a baseline system using Frequency of Least Occurrence stacking techniques
- Identify advanced malware hiding techniques, including code injection and rootkits
- Employing indicators of compromise to automate analysis
- Analysis of memory from infected systems:
- TDL3/ TDSS
- Cozyduke RAT
- StormWorm Rootkit
- Black Energy Rootkit
- WMI and PowerShell
- Cobalt Strike Beacons
- Custom APT command and control malware
- Remote and Enterprise Incident Response
- Remote Endpoint Access in the Enterprise
- RemoteEndpoint Host-based Analysis
- Scalable Host-based Analysis (one analyst examining 1,000 systems) and Data Stacking
- Remote Memory Analysis
- Triage and Enpoint Detection and Reponse (EDR)
- Endpoint Triage Collection
- EDR Capabilities and Challenges
- EDR and Memory Forensics
- Memory Acquisition
- Acquisition of System Memory from both Windows 32/64 Bit Systems
- Hibernation and Pagefile Memory Extraction and Conversion
- Virtual Machine Memory Acquisition
- Memory changes in Windows 10
- Windows 10 Virtual Secure Mode
- Memory Forensics Analysis Process for Response and Hunting
- Identify Rogue Processes
- Analyze Process DLLs and Handles
- Review Network Artifacts
- Look for Evidence of Code Injection
- Check for Signs of a Rootkit
- Acquire Suspicious Processes and Drivers
- Memory Forensics Examinations
- Live Memory Forensics
- Advanced Memory Analysis with Volatility
- Webshell Detection Via Process Tree Analysis
- Code Injection, Malware, and Rootkit Hunting in Memory
- WMI and PowerShell Processes
- Extract Typed Adversary Command Lines
- Investigate Windows Services
- Hunting Malware Using Comparison Baseline Systems
- Find and Dump Cached Files from RAM
- Memory Analysis Tools
- Rekall & Google Rapid Response
- Comae Windows Memory Toolkit
Timeline analysis will change the way you approach digital forensics, threat hunting, and incident response...forever.
Learn advanced incident response and hunting techniques uncovered via timeline analysis directly from the authors who pioneered timeline analysis tradecraft. Temporal data are located everywhere on a computer system. Filesystem modified/access/creation/change times, log files, network data, registry data, and Internet history files all contain time data that can be correlated into critical analysis to successfully solve cases. Pioneered by Rob Lee in 2001, timeline analysis has become a critical incident response, hunting, and forensics technique. New timeline analysis frameworks provide the means to conduct simultaneous examinations of a multitude of time-based artifacts. The analysis that once took days now takes minutes.
This section will step you through the two primary methods of building and analyzing timelines created during advanced incident response, threat hunting, and forensic cases. Exercises will show analysts how to create a timeline and also how to introduce the key methods to help you use those timelines effectively in your cases.
- Using timeline analysis, track adversary activity by hunting an APT group's footprints of malware, lateral movement, and persistence
- Target hidden and time-stomped malware and utilities that an APTuses to move in the network and maintain its presence
- Track APT activity second-by-second through in-depth super-timeline analysis
- Observe targeted attackers laterally move to other systems in the enterprise by watching a trail left in filesystem times, registry, Shimcache, and other temporal-based artifacts
- Learn how to filter system artifact, file system, and registry timelines to target specific data efficiently
- Timeline Analysis Overview
- Timeline Benefits
- Prerequisite Knowledge
- Finding the Pivot Point
- Timeline Context Clues
- Timeline Analysis Process
- Memory Analysis Timeline Creation
- Memory Timelining
- Filesystem Timeline Creation and Analysis
- MACB Meaning by Filesystem
- Windows Time Rules (File Copy versus File Move)
- Filesystem Timeline Creation Using Sleuthkit and fls
- Bodyfile Analysis and Filtering Using the mactime Tool
- Super Timeline Creation and Analysis
- Super Timeline Artifact Rules
- Program Execution, File Knowledge, File Opening, File Deletion
- Timeline Creation with log2timeline/Plaso
- log2timeline Input Modules
- log2timeline Output Modules
- Filtering the Super Timeline Using psort
- Targeted Super Timeline Creation
- Automated Super Timeline Creation
- Super Tmeline Analysis
- Volume Shadow Copy Timelining
Advanced adversaries are good. We must be better.
Over the years, we have observed that many incident responders and threat hunters have a challenging time finding threats without pre-built indicators of compromise or threat intelligence gathered before a breach. This is especially true in APT adversary intrusions. This advanced session will demonstrate techniques used by first responders to identify malware or forensic artifacts when very little information exists about their capabilities or hidden locations. We will discuss techniques to help funnel possibilities down to the candidates most likely to be evil malware trying to hide on the system.
- Volume shadow snapshot analysis
- Timelines across volume shadow snapshots
- Anti-Forensics analysis using various components of the NTFS filesystem
- Timestomp checks against suspicious files
- Advanced data recovery with records carving and deleted volume shadow copy recovery
- Cyber Threat Intelligence
- Importance of Cyber Threat Intelligence
- Understanding the "Kill Chain"
- Threat Intelligence Creation and Use During Incident Response and Threat Hunting
- Creation of Indicators of Compromise
- Incident Response Team Life-Cycle Overview
- Malware and Anti-Forensic Detection
- NTFS Filesystem Analysis
- Master File Table (MFT) Critical Areas
- NTFS System Files
- NTFS Metadata Attributes ($Standard_Information, $Filename, $Data)
- Rules of Windows Timestamps for $StdInfo and $Filename
- Timestomp detection via NTFS Timestamp Analysis
- Resident versus Nonresident Files
- Hidden data in Alternate Data Streams
- Finding Wiped/Deleted Files using Directory Listings and the $I30 file
- Filesystem Flight Recorders: Transaction Logging and the $Logfile and $UsnJrnl
- What Happens When Data Is Deleted from an NTFS Filesystem?
- Anti-Forensic Detection Methodologies
- MFT Anomalies
- Timeline Anomalies
- Deleted File
- Deleted Registry Keys
- File Wiping
- Adjusting Timestamps
- Identifying Compromised Hosts without Active Malware
- Rapid Data Triage Analysis
- Cyber Threat Intelligence and Indicators of Compromise Searching
- Evidence of Persistence
- Super-timeline Examination
- Packing/Entropy/Executable Anomaly/Density Checks
- System Logs
- Memory Analysis
- Malware Identification
This incredibly rich and realistic enterprise intrusion exercise is based on a real-world advanced persistent threat (APT) group. It brings together techniques learned earlier in the course and tests your newly acquired skills in an investigation into an attack by an advanced adversary. The challenge brings it all together using a real intrusion into a complete Windows enterprise environment. You will be asked to uncover how the systems were compromised in the initial intrusion, find other compromised systems via adversarylateral movement, and identify intellectual property stolen via data exfiltration. You will walk out of the course with hands-on experience investigating a real attack, curated by a cadre of instructors with decades of experience fighting advanced threats from attackers ranging from nation-states to financial crime syndicates and hactivist groups.
- The Intrusion Forensic Challenge will ask each incident response team to analyze multiple systems in an enterprise network with many endpoints.
- During the challenge, each incident response team will be asked to answer key questions and address critical issues in the different categories listed below, just as they would during a real breach in their organizations:
IDENTIFICATION AND SCOPING:
1. How and when did the APT group breach our network?
2. List all compromised systems by IP address and specific evidence of compromise.
3. When and how did the attackers first laterally move to each system?
CONTAINMENT AND THREAT INTELLIGENCE GATHERING:
4. How and when did the attackers obtain domain administrator credentials?
5. Once on other systems, what did the attackers look for on each system?
6. Find extracted email from executive accounts and perform damage assessment.
7. Determine what was stolen: Recover any archives exfiltrated, find encoding passwords, and extract the contents to verify extracted data.
8. Collect and list all malware used in the attack.
9. Develop and present security intelligence and host and network based indicators of compromise describing attacker tradecraft.
REMEDIATION AND RECOVERY:
10. What level of account compromised occurred. Is a full password reset required during remediation?
11. Based on the attacker techniques and tools discovered during the incident, what are the recommended steps to remediate and recover from this incident?
a. What systems need to be rebuilt?
b. What IP addresses need to be blocked?
c. What countermeasures should we deploy to slow or stop these attackers if they come back?
d. What recommendations would you make to detect these intruders in our network again?
- If you have attended FOR500, you may want to bring your copy of the FOR500 - Windows SIFT Workstation Virtual Machine, as you can use it for the final challenge and for many of the exercises in FOR508.
- Bring/install any other forensic tool you feel could be useful (Splunk, EDR, EnCase, FTK, etc). For the final challenge at the end of the course, you can utilize any forensic tool, including commercial capabilities, to help you and your team. If you have any dongles, licensed software, etc., you are free to use them.
- Please do not use the version of the SIFT Workstation downloaded from the Internet. We will provide you with a version specifically configured for the FOR508 materials on Day 1 of the course.
If you have additional questions about the laptop specifications, please contact email@example.com.
GIAC Certified Forensic Analyst
"...The enemy is getting better and bolder, and their success rate is impressive. "We can stop them, but to do so, we need to field more sophisticated incident responders and digital forensics investigators. We need lethal digital forensics experts who can detect and eradicate advanced threats immediately. A properly trained incident responder could be the only defense your organization has left during a compromise. Forensics 508: Advanced Digital Forensics, Incident Response, and Threat Hunting is crucial training for you to become the lethal forensicator who can step up to these advanced threats. The enemy is good. We are better. This course will help you become one of the best." - Rob Lee, Course Author
The GCFA certifies that candidates have the knowledge, skills, and ability to conduct formal incident investigations and handle advanced incident handling scenarios, including internal and external data breach intrusions, advanced persistent threats, anti-forensic techniques used by attackers, and complex digital forensic cases. The GCFA certification focuses on core skills required to collect and analyze data from Windows and Linux computer systems.
Advanced Incident Response and Digital Forensics
Memory Forensics, Timeline Analysis, and Anti-Forensics Detection
Threat Hunting and APT Intrusion Incident Response
FOR508 is an advanced incident response and threat hunting course that focuses on detecting and responding to advanced persistent threats and organized crime threat groups. We do not cover the introduction or basics of incident response, Windows digital forensics, or hacker techniques in this course.
We recommend that you should have a background in FOR500: Windows Forensics prior to attending this course.
A properly configured system is required to fully participate in this course. These requirements are the mandatory minimums. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.
This is common sense, but we will say it anyway. Back up your system before class. Better yet, do not have any sensitive data stored on the system. SANS can't responsible for your system or data.
MANDATORY FOR508 SYSTEM HARDWARE REQUIREMENTS:
- CPU: 64-bit Intel i5/i7 (4th generation+) - x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)
- It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.
BIOS settings must be set to enable virtualization technology, such as "Intel-VT".
Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary. Test it!
- 16 GB (Gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 16 GB of RAM or higher of RAM is mandatory and minimum.
- USB 3.0 Type-A port is required. At least one open and working USB 3.0 Type-A port is required. (A Type-C to Type-A adapter may be necessary for newer laptops.) (Note: Some endpoint protection software prevents the use of USB devices - test your system with a USB drive before class to ensure you can load the course data.)
- 200 Gigabytes of Free Space on your System Hard Drive - Free Space on Hard Drive is critical to host the VMs we distribute
- Local Administrator Access is required. This is absolutely required. Don't let your IT team tell you otherwise. If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
- Wireless 802.11 Capability
MANDATORY FOR508 HOST OPERATING SYSTEM REQUIREMENTS:
- Host Operating System: Latest version of Windows 10 or macOS 10.15.x
Please note: It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.
PLEASE INSTALL THE FOLLOWING SOFTWARE PRIOR TO CLASS:
- Download and install VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+ on your system prior to class beginning. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website.
- Download and install 7Zip (for Windows Hosts) or Keka (macOS).
Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.
SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.
"In describing the advanced persistent threat (APT) and advanced adversaries, many experts have said, 'There are people smarter than you, who have more resources than you, and who are coming for you. Good luck with that.' They were not joking. The results over the past several years clearly indicate that hackers employed by nation-states and organized crime are racking up success after success. The APT has compromised hundreds of organizations. Organized crime organizations using botnets are exploiting Automated Clearing House (ACH) fraud daily. Similar groups are penetrating banks and merchants, stealing credit card data. Fortune 500 companies are beginning to detail data breaches and hacks in their annual stockholder reports.
"In other words, the enemy is getting better and bolder, and their success rate is impressive.
"We can stop them, but to do so, we need to field more sophisticated incident responders and digital forensics investigators. We need lethal digital forensics experts who can detect and eradicate advanced threats immediately. A properly trained incident responder could be the only defense your organization has left during a compromise. Forensics 508: Advanced Digital Forensics, Incident Response, and Threat Hunting is crucial training for you to become the lethal forensicator who can step up to these advanced threats. The enemy is good. We are better. This course will help you become one of the best."
- Rob Lee
"We live in a world of unimaginable amounts of data stored on immensely large and complicated networks. Our adversaries use this complexity against us to slice through our defenses and take virtually anything they want, anytime they want it. While this is our current state, it will not be our future. Incident response is at an inflection point. Old models are being upgraded to make defenders more effective and nimble in response to more sophisticated and aggressive attackers. The most successful incident response teams are evolving rapidly due to near-daily interaction with adversaries. New tools and techniques are being developed, providing better visibility and making the network more defensible. There are an increasing number of success stories, with organizations quickly identifying intrusions and rapidly remediating them.
We created this course to build upon those successes. Like the field itself, the course is continuously updated, bringing the latest advances into the classroom. Whether you are just moving into the incident response field or are already leading hunt teams, FOR508 facilitates learning from others' experiences and develops the necessary skills to take you to the next level."
- Chad Tilbury