SEC504: Hacker Tools, Techniques, and Incident Handling

GIAC Certified Incident Handler (GCIH)
GIAC Certified Incident Handler (GCIH)
  • In Person (6 days)
  • Online
38 CPEs

SEC504 helps you develop the skills to conduct incident response investigations. You will learn how to apply a dynamic incident response process to evolving cyber threats, and how to develop threat intelligence to mount effective defense strategies for cloud and on-premises platforms. We'll examine the latest threats to organizations, from watering hole attacks to endpoint security bypass, enabling you to get into the mindset of attackers and anticipate their moves. SEC504 gives you the information you need to understand how attackers scan, exploit, pivot, and establish persistence in cloud and conventional systems. To help you develop retention and long-term recall of the course material, 50 percent of class time is spent on hands-on exercises, using visual association tools to break down complex topics. This course prepares you to conduct cyber investigations and will boost your career by helping you develop these in-demand skills.

Course Authors:

What You Will Learn

The goal of modern cloud and on-premises systems is to prevent compromise, but the reality is that detection and response are critical. Keeping your organization out of the breach headlines depends on how well incidents are handled to minimize loss to the company.

In SEC504, you will learn how to apply a dynamic approach to incident response. Using indicators of compromise, you will practice the steps to effectively respond to breaches affecting Windows, Linux, and cloud platforms. You will be able to take the skills and hands-on experience gained in the course back to the office and apply them immediately.

Understanding the steps to effectively conduct incident response is only one part of the equation. To fully grasp the actions attackers take against an organization, from initial compromise to internal network pivoting, you also need to understand their tools and techniques. In the hands-on environment provided by SEC504, youll use the tools of the attackers themselves in order to understand how they are applied and the artifacts the attackers leave behind. By getting into the mindset of attackers, you will learn how they apply their trade against your organization, and youll be able to use that insight to anticipate their moves and build better defenses.

In SEC504, you will learn:

  • How to apply a dynamic approach to incident response
  • How to identify threats using host, network, and log analysis
  • Best practices for effective cloud incident response
  • Cyber investigation processes using live analysis, network insight, and memory forensics
  • Defense spotlight strategies to protect critical assets
  • Attacker techniques to evade endpoint detection tools
  • How attackers exploit complex cloud vulnerabilities
  • Attacker steps for internal discovery and lateral movement after an initial compromise
  • The most effective attacks to bypass system access controls
  • The crafty techniques attackers use, and how to stop them

Syllabus (38 CPEs)

Download PDF
  • Overview

    The first section of SEC504 focuses on how to develop and build an incident response process in your organization by applying the Dynamic Approach to Incident Response (DAIR) to effectively verify, scope, contain, assess, and remediate threats. We'll apply this process in-depth with hands-on labs and examples from real-world compromises.

    • Live Windows examination
    • Network investigation
    • Memory investigation
    • Malware investigation
    • Cloud investigation

    Incident Response

    • Case study: Argous Corporation compromise
    • Dynamic Approach to Incident Response
    • Investigative analysis: Examining incident evidence

    Digital Investigations

    • Techniques for digital investigation
    • Establishing an incident timeline
    • Investigation efficiency: Data reduction

    Live Examination

    • Identifying suspicious Windows processes
    • Correlating network and persistence activity
    • Enumerating Windows auto-start extensibility points
    • Leveraging Sysinternals for live Windows examinations

    Network Investigations

    • Identifying compromised host beaconing with proxy server logs
    • Filtering network activity to identify indicators of compromise
    • Assessing encrypted network traffic with multiple data sources
    • Building the incident timeline

    Memory Investigations

    • Collecting volatile memory from a compromised host
    • Conducting offline analysis of attacker persistence
    • Using Volatility to inspect attacker malware

    Malware Investigations

    • Assessing attacker malware in a custom test environment
    • Using snapshot and continuous recording tools
    • Inspecting malware actions with RegShot and Procmon
    • Identifying malicious code on Windows

    Cloud Investigations

    • Steps for conducting a cloud security incident investigation
    • Essential cloud logging assets for incident response
    • Data collection and isolation for compromise assessment
    • Applying cloud recovery and remediation following an incident
    • Complete cloud compromise incident response walkthrough

    Bootcamp: Linux Olympics

    • Building command line skills at your own pace
    • Working with Linux file systems and permissions
    • Using JQ to parse and filter JSON data
    • Using file parsing tools, including grep, cut, and awk
    • Linux compromise incident response walkthrough
  • Overview

    In this course section we'll look at the techniques attackers use to conduct reconnaissance as a pre-attack step, including how they use open-source intelligence, network scanning, and target enumeration attacks to find the gaps in your network security. You'll use attacker techniques to assess the security of a target network, evaluating popular protocols and endpoints for Windows, Linux, and cloud targets. After delivering the attacks, you'll investigate the logging data and evidence that remains to recognize these attacks as they happen.

    • Open-Source Intelligence with SpiderFoot
    • Domain Name System (DNS) Reconnaissance and Enumeration
    • Host Discovery and Assessment with Nmap
    • Shadow Cloud Asset Discovery with Masscan
    • Windows Server Message Block (SMB) Session Attacks
    • Windows Password Spray Attack Detection

    MITRE ATT&CK Framework Introduction

    • Using ATT&CK to guide an incident response investigation
    • Staying current with changing attack techniques
    • Leveraging ATT&CK for threat intelligence

    Open-Source Intelligence

    • Enumerating targets without being detected
    • Host identification through domain and public certificate authority data
    • User account compromise assessment
    • Automating open-source intelligence collection with SpiderFoot

    DNS Interrogation

    • Mining public DNS servers for organization data
    • Automating host enumeration with dns-brute
    • DNS server log inspection for attack identification
    • Creative host identification using manual and automated tools

    Website Reconnaissance

    • Information-gathering from public websites
    • Parsing Exchangeable Image File Format (EXIF) data from public documents
    • Optimizing search engine reconnaissance interrogation
    • Abstracting attack identification using public sources
    • Limiting website-sensitive data disclosure

    Network and Host Scanning with Nmap

    • Host enumeration and discovery with Nmap
    • Internal and external network mapping and visualization
    • Minimizing network activity to avoid detection
    • Deep host assessment with Nmap Scripting Engine tools

    Cloud Spotlight: Cloud Scanning

    Enumerating shadow cloud targets

    • Accelerating scans with Masscan
    • Walkthrough: Scanning Amazon Web Services for target discovery
    • Attributing cloud hosts to a target organization
    • Visual representation of identified targets with EyeWitness

    Server Message Block (SMB) Sessions

    • Understanding Windows SMB: Essential skill development
    • Identifying SMB attacks against Windows
    • Using built-in tools for SMB password guessing attacks
    • Enumerating Windows domains using SharpView and BloodHound
    • Understanding SMB security features

    Defense Spotlight: DeepBlueCLI

    • Identifying attacks using Windows Event Logs
    • Differentiating attacks from false positives
    • Remote host assessment for compromise identification
    • Tips for fast assessment to begin incident analysis
  • Overview

    Password attacks are the most reliable mechanism for attackers to bypass defenses and gain access to your organization's assets. In this course section we'll investigate the complex attacks that exploit password and multi-factor authentication weaknesses using the access gained to access other network targets.

    • Password Guessing Attacks with Hydra
    • Password Cracking with John the Ripper
    • Password Cracking with Hashcat
    • Domain Password Audit Tool
    • Cloud Bucket Discovery
    • The Many Uses of Netcat

    Password Attacks

    • Password attack trifecta: Guessing, spray, and credential stuffing
    • Techniques for bypassing password attack defenses
    • Understanding real-world authentication attacks

    Understanding Password Hashes

    • Weaknesses in Windows password hash formats
    • Collecting password hashes in Windows, Linux, and cloud targets
    • Mitigating GPU-based password cracking with scrypt and Argon2

    Password Cracking

    • Recovering passwords from hashes with John the Ripper and Hashcat
    • Accelerating password cracking with GPUs and cloud assets
    • Effective cracking with password policy masks
    • Multi-factor authentication and password cracking implications

    Defense Spotlight: Domain Password Audit Tool (DPAT)

    • Password cracking as a defense opportunity with the DPAT
    • Collecting Windows domain hashes for security analysis
    • Identifying systemic vulnerabilities in password selection
    • Safely reporting on password selection faults

    Cloud Spotlight: Insecure Storage

    • Case study: Cloud bucket storage exposure
    • Understanding cloud storage for Amazon Web Services, Azure, and Google Compute
    • Discovering insecure bucket storage
    • Walkthrough: Insecure storage to website persistence compromise
    • Identifying insecure cloud storage access

    Multi-purpose Netcat

    • Internal data transfer to evade monitoring controls
    • Pivoting and lateral movement
    • Listener and reverse TCP backdoors on Linux and Windows
    • Detailed look at attacker post-compromise techniques
  • Overview

    In this course section we'll begin our look at target exploitation frameworks that take advantage of weaknesses on public servers and client-side vulnerabilities. Using the implicit trust of a public website, you'll apply attacker tools and techniques to exploit browser vulnerabilities, execute code with Microsoft Office documents, and exploit the many vulnerabilities associated with vulnerable web applications.

    • Metasploit Attack and Analysis
    • Client-side Exploitation with the Browser Exploitation Framework (BeEF)
    • Windows System Resource Usage Database Analysis
    • Command Injection Attack
    • Cross-Site Scripting Attack
    • SQL Injection Attack
    • Server Side Request Forgery (SSRF) and Instance Metadata Service (IMDS) Attack

    Metasploit Framework

    • Using Metasploit to identify, configure, and deliver exploits
    • Selecting payloads that grant access while evading defenses
    • Establishing and using Command & Control (C2) victim access
    • Identifying Metasploit and Meterpreter fingerprints for incident response

    Drive-By Attacks

    • Phishing and malicious Microsoft Office files
    • Leveraging a watering hole to attack victim browsers
    • Case study: Control system attack through watering hole forum compromise
    • Building extensible payloads for effective attacks
    • Customizing exploits for defense bypass

    Defense Spotlight: System Resource Usage Monitor

    • Leveraging Windows diagnostics for incident response
    • Assessing incident network activity using built-in Windows data
    • Case study: Data theft and terminated employee workstation analysis

    Command Injection

    • Compromising websites with command injection
    • Walkthrough: Falsimentis community service website attack
    • Applying command injection in non-website targets
    • Attack access enumeration through command injection
    • Auditing web applications for command injection flaws

    Cross-Site Scripting (XSS)

    • Exploiting victim browsers through server flaws
    • Classifying XSS types for opportunistic or target attacks
    • Cookie theft, password harvesting, and camera/microphone capture attacks
    • Using content security policies (CSP) to stop XSS

    SQL Injection

    • Understanding SQL constructs and developer errors
    • Extracting data through SQL injection
    • Using Sqlmap to automate vulnerability discovery
    • SQL injection against cloud databases: Relational Database Service (RDS), Spanner, Azure SQL

    Cloud Spotlight: SSRF and IMDS Attacks

    • Identifying server-side request forgery vulnerabilities
    • Understanding common requests vs. server-side requests
    • Walkthrough: Falsimentis federated SSO attack
    • Obtaining cloud keys through IMDS attacks

  • Overview

    Building on password, public-facing, and drive-by attacks, we'll look at the attacks that happen after initial exploitation. You'll see how attackers bypass endpoint protection systems and use an initial foothold to gain access to internal network targets. You'll then apply the techniques you learn with privileged insider Local Area Network (LAN) attacks, using privileged access to establish persistence, how attackers scan for and collect data from a compromised organization. You will apply these skills to assess the security risks of a vulnerable cloud deployment through visualization and automated assessment techniques. Finally, we'll look at the steps to take after the course is over, turning what you've learned into long-term skills and helping you prepare for the certification exam.

    • Pivoting and Lateral Movement with Metasploit
    • Insider Attack with Responder
    • Windows Data Hiding: Alternate Data Streams
    • Establishing Persistence with Metasploit
    • Network Threat Hunting with Real Intelligence Threat Analytics (RITA)
    • Cloud Configuration Assessment with ScoutSuite
    • Building Review Cards with Anki

    Endpoint Security Bypass

    • Applying ghostwriting to evade signature detection
    • Evading application safelist controls
    • Using signed executables to evade endpoint controls
    • Getting the most value from Endpoint Detection and Response (EDR) platforms

    Pivoting and Lateral Movement

    • Using Metasploit features for lateral movement
    • Attacker detection evasion through pivoting
    • Using Linux and Windows features for advanced exploitation
    • Command & Control (C2) for privileged internal access

    Hijacking Attacks

    • Exploiting privileged LAN access
    • Attacking default Windows vulnerable protocols
    • Password harvesting on the LAN

    Covering Tracks

    • Hiding collected data on Windows and Linux
    • Log editing techniques for both simple and complex log formats
    • Building tamper-proof logging platforms

    Establishing Persistence

    • Exploiting Windows Silent Process Exit
    • Windows Management Instrumentation (WMI) Event Subscription persistence techniques
    • Exploiting Windows Active Directory: Golden Ticket attacks
    • Web shell access and multi-platform persistence
    • Cloud keys and backdoor accounts in Azure, Amazon Web Services, and Google Compute

    Defense Spotlight: Real Intelligence Threat Analytics

    • Threat hunting through network analysis
    • Identifying beacons and C2 on your network
    • Characterizing network oddities: Long connections
    • Catching DNS exfiltration and access attacks

    Data Collection

    • Linux and Windows post-exploitation password harvesting
    • Evading detection controls: Mimikatz
    • Attacking password managers on Windows and macOS
    • Keystroke logging attacks

    Cloud Spotlight: Cloud Post-Exploitation

    • Privilege enumeration and escalation in cloud environments
    • Identifying stealthy backdoors in Azure
    • Using cloud attack frameworks: Pacu and GCP PrivEsc
    • Case study: Access to database dumping in Google Compute
    • Built-in tools for data access: Microsoft 365 Compliance Search
    • Assessing your cloud deployment for vulnerabilities

    Where to Go from Here

    • Tips for developing long-term recall and memory retention
    • Applying spaced repetition theory using Anki
    • Staying motivated and finding time for skill development
    • Recommendations for passing your certification exam
  • Overview

    Our Capture-the-Flag event is a full day of hands-on activity that has you working as a consultant for ISS Playlist, a fictitious company that has recently been compromised. You will apply all of the skills you've learned in class, using the same techniques used by attackers to compromise modern, sophisticated network environments. You will work on a team or independently to scan, exploit, and complete post-exploitation tasks against a cyber range of target systems including Windows, Linux, Internet of Things devices, and cloud targets. This hands-on challenge is designed to help players practice their skills and reinforce concepts learned throughout the course. With an integrated hint system to give you the on-demand guidance you need to succeed, the event guides you through the steps to successfully compromise target systems, bypass endpoint protection platforms, pivot to internal network high-value hosts, and exfiltrate company data.

    • Target Discovery and Enumeration
    • Applying Open-Source Intelligence and Reconnaissance Information-Gathering
    • Public-Facing Asset Compromise
    • Email Compromise
    • Attacking Windows Active Directory
    • Password Spray, Guessing, and Credential Stuffing Attacks
    • Post-Exploitation Pivoting and Lateral Movement
    • Choosing, Configuring, and Delivering Exploits
    • Internal Attacker Compromise Attribution

GIAC Certified Incident Handler

The GIAC Incident Handler certification validates a practitioner’s ability to detect, respond, and resolve computer security incidents using a wide range of essential security skills. GCIH certification holders have the knowledge needed to manage security incidents by understanding common attack techniques, vectors and tools, as well as defend against and respond to such attacks when they occur.

  • Incident Handling and Computer Crime Investigation

  • Computer and Network Hacker Exploits

  • Hacker Tools (Nmap, Nessus, Metasploit and Netcat)

Laptop Requirements

Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

It is critical that you back-up your system before class. It is also strongly advised that you do not bring a system storing any sensitive data.


  • 64-bit Intel i5/i7 2.0+ GHz processor
  • CRITICAL NOTE: Apple systems using the M1 processor line cannot perform the necessary virtualization functionality and therefore cannot in any way be used for this course.
  • Your system's processor must be a 64-bit Intel i5 or i7 2.0 GHz processor or higher. To verify on Windows 10, press Windows key + "I" to open Settings, then click "System", then "About". Your processor information will be listed near the bottom of the page. To verify on a Mac, click the Apple logo at the top left-hand corner of your display and then click "About this Mac".


  • Enabled "Intel-VT"
  • Intel's VT (VT-x) hardware virtualization technology must be enabled in your system's BIOS or UEFI settings. You must be able to access your system's BIOS to enable this setting in order to complete lab exercises. If your BIOS is password-protected, you must have the password. This is absolutely required.


  • 16 GB RAM is highly recommended for the best experience. To verify on Windows 10, press Windows key + "I" to open Settings, then click "System", then "About". Your RAM information will be toward the bottom of the page. To verify on a Mac, click the Apple logo at the top left-hand corner of your display and then click "About this Mac".

Hard Drive Free Space

  • 100 GB of FREE space on the hard drive is critical to host the VMs and additional files we distribute. SSD drives are also highly recommended, as they allow virtual machines to run much faster than mechanical hard drives.

Operating System

  • Your system must be running either the latest version of Windows 10, macOS 10.15.x or later, or Linux that also can install and run VMware virtualization products described below.

Additional Software Requirements

VMware Player Install

  • VMware Workstation Player 16, VMware Fusion 12, or VMware Workstation 16
  • Install VMware Player 16, VMware Fusion 12, or VMware Workstation 16. Older versions will not work for this course. Choose the version compatible with your host OS. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their Web site. VMware Workstation Player is a free download that does not need a commercial license but has fewer features than Workstation. THIS IS CRITICAL: Other virtualization products, such as Hyper-V and VirtualBox, are not supported and will not work with the course material.

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

If you have additional questions about the laptop specifications, please contact

Author Statement

"Attacker tools and techniques have changed, and we need to change our incident response techniques to match. Since I took over as author of SEC504 in 2019, I have rewritten the entire course to give you the skills you need to succeed at incident response. Whether the attacks are Windows-focused or involve attacking critical database platforms or exploiting cloud vulnerabilities, you'll be prepared to effectively identify the attack, minimize the impact, and respond efficiently. With your knowledge of hacker tools and techniques, and by using defense skills that dramatically improve security, you will be ready to become the subject-matter expert your organization needs to meet today's cyber threats."

-Joshua Wright

"Our instructor Josh was incredible! Engaging, enthusiastic, extremely knowledgeable (especially vim, WOW). His enthusiasm is contagious and really motivating to the material. Keep up the great work Josh!" - Jen F., US Federal Agency


Incident response is the most underused aspect in small companies. SEC504 gives us the ability to help management understand the value.
David Freedman
Nationwide Payment Solutions
Even by my very high standards for SANS, SEC504 is awesome across the board--the quality of the materials, the instructor, the platform, and the support staff. This course teaches the genuine, hands-on skills needed in r
Darryl S
US Federal Agency
SEC504 is a great course and well-organized. The labs are amazing and well-tailored to learning the content, and the instructor is knowledgeable and great at explaining the content. This was my first SANS training, and I
Alex Colclough
Clayton Homes
Great content! As a developer it is extremely useful to understand exploits and how better coding practices help your security position.
Jeremy Bramson
Bramson Welch & Associates
SEC504 has been the single best course I have ever taken. It leaves the student prepared and able to understand a broad scope of content in security.
Joshua Nielson

    Register for SEC504

    • In Person

    Training events and topical summits feature presentations and courses in classrooms around the world.

    Learn more
    • Live Online

    Live, interactive sessions with SANS instructors over the course of one or more weeks, at times convenient to students worldwide.

    Learn more
    • OnDemand

    Study and prepare for GIAC Certification with four months of online access. Includes labs and exercises, and support.

    Learn more