SEC504™: Hacker Tools, Techniques, and Incident Handling™

GIAC Certified Incident Handler (GCIH)
GIAC Certified Incident Handler (GCIH)
  • In Person (6 days)
  • Online
38 CPEs

Transform your incident response skills and get into the mindset of attackers with SEC504™ training. Through 30+ hands-on labs, you'll learn to investigate cybersecurity incidents, develop threat intelligence, and apply defense strategies against real-world threats. From password attacks to MFA bypass techniques on cloud services, this course takes you deep into the latest hacker tactics. Engage with cutting-edge tools and simulate live attacks to sharpen your defensive capabilities, all while preparing for the GIAC GCIH certification. You'll leave ready to defend both cloud and on-premises environments against evolving cyber threats.

Course Authors:

What You Will Learn

In today's evolving threat landscape, breaches are inevitable. What's crucial is how fast and effectively you can detect and respond to these attacks. Staying out of breach headlines hinges on your ability to complete comprehensive incident response actions to neutralize threats.

SEC504™ training prepares you to apply dynamic and effective incident response strategies. You'll identify indicators of compromise (IoCs) and respond to breaches affecting Windows, Linux, and cloud platforms-skills you can immediately apply to protect your organization from real-world threats.

A big focus in SEC504™ training is applying what you learn: 50% of the course is hands-on where you will attack, defend, and assess the damage done by threat actors. You'll reproduce real-world breaches on complex network environments, applications, and host platforms, then assess the damage caused by threat actors. In SEC504™ training you have unlimited access to our immersive labs, allowing you to repeat exercises as often as needed. Each lab includes in-depth walkthrough videos designed to support your learning.

To truly defend your organization, you need to think like an attacker. In SEC504™ training's immersive labs, you'll use the same tools and techniques adversaries rely on, learning to recognize the artifacts they leave behind. By adopting their mindset and studying their tactics, techniques, and procedures (TTPs), you'll gain valuable insights to develop your Cyber Threat Intelligence (CTI) and strengthen your defenses. You will develop actionable skills that will immediately enhance your organization's security posture, making your investment in training pay off from day one.

Business Takeaways

  • Apply a dynamic approach to incident response
  • Identify threats using host, network, and log analysis
  • Best practices for effective cloud incident response
  • Leverage PowerShell for data collection and cyber threat analysis
  • Cyber investigation processes using live analysis, network insight, memory forensics, and malware reverse engineering
  • How to accelerate your incident response using generative AI systems
  • Defense spotlight strategies to protect critical assets
  • How attackers leverage cloud systems against organizations
  • Attacker techniques to evade endpoint detection tools including EDR and XDR platforms
  • Attacker steps for internal discovery and lateral movement after an initial compromise
  • How attackers exploit publicly accessible systems including Microsoft 365

Skills Learned

At the completion of SEC504™ training you will be able to:

  • Effectively respond to an incident in your organization in order to limit damage
  • Evaluate the evidence in a breach in order to identify the extent of the compromise
  • Identify shadow cloud systems and other threats that can expose your organization
  • Use attack tools against cloud and on-premises systems to assess your exposure
  • Apply effective defenses that significantly improve security and stop attacks
  • Test security defense tools to evaluate their effectiveness
  • Develop threat intelligence by assessing attacker tools and techniques

What You Will Receive

  • Unlimited access to all hands-on lab exercises that never expires
  • Printed and electronic course books and a hands-on workbook
  • MP3 audio files of the entire course
  • Detailed video walkthroughs for all lab exercises
  • Visual association maps to break down complex material
  • A digital index for quick reference to all material
  • Bonus content and hands-on exercises to develop your skills beyond the course
  • Essential cheat sheets for tools and complex analysis tasks

Syllabus (38 CPEs)

Download PDF
  • Overview

    The first section of SEC504™ training focuses on how to develop and build an incident response process in your organization. You'll learn how to apply the Dynamic Approach to Incident Response (DAIR) process to effectively verify, scope, contain, assess, and remediate threats. We'll apply this process in-depth with hands-on labs and examples from real-world compromises using PowerShell and other valuable analysis tools. You'll also learn how you can accelerate the incident analysis process without sacrificing accuracy using generative AI platforms.

    Exercises
    • Live Windows investigation with PowerShell
    • Network investigation
    • Memory investigation
    • Malware investigation
    • Lightning Lab: WordPress Log Assessment
    • Lightning Lab: Tcpdump Introduction
    • Lightning Lab: Malware Strings
    Topics
    • Incident Response
      • Case study: Argous Corporation compromise
      • Dynamic Approach to Incident Response
      • Investigative analysis: Examining incident evidence
      • Leveraging multiple evidence sources for incident analysis
    • Live Investigation
      • Using PowerShell for Windows threat hunting
      • Identifying suspicious Windows processes
      • Correlating network and persistence activity
      • Assessing file-less malware threats
      • Enumerating Windows auto-start extensibility points
      • Leveraging Sysinternals for live Windows examinations
    • Network Investigation
      • Identifying compromised host beaconing with proxy server logs
      • Filtering network activity to identify indicators of compromise
      • Assessing encrypted network traffic with multiple data sources
      • Building the incident timeline
    • Memory Investigation
      • Collecting volatile memory from a compromised host
      • Conducting offline analysis of attacker persistence
      • Using Volatility 3 to investigate malware
      • Build attacker event timelines using non-volatile memory captures
    • Malware Investigation
      • Assessing attacker malware in a safe test environment
      • Using snapshot and continuous recording tools
      • Inspecting malware actions with RegShot and Procmon
      • Identifying malicious code on Windows
    • Accelerating IR with Generative AI
      • Summarizing malicious code artifacts for reporting
      • Essential prompt engineering tips
      • Automating data deobfuscation with AI
      • Generating scripts to accelerate data collection and analysis
      • Tips for AI training for superior prompt results
      • Recognizing and mitigating the risks of AI-assisted incident response
    • Bootcamp: Linux Olympics
      • Learn Linux using an interactive learning environment
      • Build command line skills at your own pace
      • Working with Linux file systems and permissions
      • Using JQ to parse and filter JSON data
      • Using file parsing tools, including grep, cut, and awk
      • Linux compromise incident response walkthrough
    • Bootcamp: PowerShell Olympics
      • Learn PowerShell on Windows using an interactive learning environment
      • Build command line skills at your own pace
      • Get started with PowerShell skills: cmdlets, functions, built-ins, and more!
      • Learn to quickly interrogate a Windows system for effective threat hunting
      • Accelerate your common analysis tasks with PowerShell automation
  • Overview

    In this course section we'll look at the techniques attackers use to conduct reconnaissance as a pre-attack step, including how they use open-source intelligence, network scanning, and target enumeration to find attack opportunities. You'll use attacker techniques to assess the security of target networks, evaluating popular protocols and endpoints for Windows, Linux, Azure, and AWS targets. After delivering the attacks, you'll investigate the logging data and evidence that remains to recognize these attacks as they happen.

    Exercises
    • Host Discovery and Assessment with Nmap
    • Shadow Cloud Asset Discovery with Masscan
    • Windows Server Message Block (SMB) Security Investigation
    • Windows Password Spray Attack Detection
    • The Many Uses of Netcat
    • Lightning Lab: Nmap Port Ranges
    • Lightning Lab: Scanning with SMBeagle
    • Lightning Lab: SMB Client Access
    • Lightning Lab: Netcat Client Features
    Topics
    • MITRE ATT&CK Framework Introduction
      • Using ATT&CK to guide an incident response investigation
      • Staying current with changing attack techniques
      • Leveraging ATT&CK for threat intelligence
    • Network and Host Scanning with Nmap
      • Host enumeration and discovery with Nmap
      • Internal and external network mapping and visualization
      • Minimizing network activity to avoid detection
      • Deep host assessment with Nmap Scripting Engine tools
    • Cloud Spotlight: Cloud Scanning
      • Accelerating scans with Masscan
      • Walkthrough: Scanning Amazon Web Services for target discovery
      • Attributing cloud hosts to a target organization
      • Visualizing targets with EyeWitness
    • Server Message Block (SMB) Security
      • Understanding Windows SMB: Essential skill development
      • Identifying SMB attacks against Windows
      • Using built-in tools for SMB password attacks
      • Understanding SMB security features
      • Exploiting SMB vulnerabilities like an attacker
    • Defense Spotlight: Hayabusa and Sigma Rules
      • Identifying attacks using Windows Event Logs and Hayabusa
      • Threat hunting using Sigma rules
      • Differentiating attacks from false positives
      • Remote host assessment for compromise identification
      • Tips for fast assessment to begin incident analysis
    • Multi-purpose Netcat
      • Data exfiltration while evading monitoring controls
      • Internal network pivoting and lateral movement
      • Implementing listener and reverse TCP backdoors on Linux and Windows
      • Detailed look at attacker post-compromise techniques
      • Living Off the Land (LOL) attacks to evade endpoint detection tools
  • Overview

    Attackers tirelessly deploy password attacks and exploits to infiltrate systems, posing a constant threat to your organization's systems. In this section, we explore multiple techniques for password compromises against on-premises and cloud systems. We'll leverage popular attacks tools including Legba for multi-protocol password attacks and Hashcat for cracking. We'll also dive into exploits frameworks like Metasploit for initial and post-compromise exploitation. We use the insight we can gain from these tools to better implement practical defenses and to inform our incident response playbooks.

    Exercises
    • Using Legba for Password Guessing and Spray Attacks
    • Bypassing Microsoft 365 authentication defenses with Amazon AWS
    • Password Cracking with Hashcat
    • Metasploit Attack and Analysis
    • Client-side Exploitation with the Browser Exploitation Framework (BeEF)
    • Lightning Lab: Password List Filtering
    • Lightning Lab: Hashcat Hash Types
    • Lightning Lab: Using Hashcat Rules
    • Lightning Lab: Metasploit Searching
    • Lightning Lab: MsfVenom Payloads
    Topics
    • Password Attacks
      • Password attack trifecta: Guessing, spray, and credential stuffing
      • Accelerating password attacks with Legba
      • Techniques for bypassing password attack defenses
      • Understanding real-world authentication attacks
    • Microsoft 365 Attacks
      • Enumerating valid Microsoft 365 user accounts
      • Assessing and bypassing Multi-Factor Authentication (MFA)
      • Attacking cloud Software as a Service (SaaS) platforms
      • Leveraging AWS services to bypass account lockout
      • Differentiating Azure Gov Cloud and enterprise cloud security
      • Investigating business email compromise
    • Understanding Password Hashes
      • Weaknesses in Windows password hash formats
      • Collecting password hashes in Windows, Linux, and cloud targets
      • Mitigating GPU-based password cracking with Yescrypt and Argon2
    • Password Cracking
      • Recovering passwords from hashes with Hashcat
      • Accelerating password cracking with GPUs and cloud assets
      • Effective cracking with password policy masks
      • Multi-factor authentication and password cracking implications
    • Metasploit Framework
      • Using Metasploit to identify, configure, and deliver exploits
      • Selecting payloads that grant access while evading defenses
      • Establishing and using Command & Control (C2) victim access
      • Identifying Metasploit and Meterpreter artifacts for incident response
    • Drive-By Attacks
      • Phishing and malicious Microsoft Office files
      • Leveraging a watering hole to attack victim web browsers
      • Case study: Control system attack through watering hole forum compromise
      • Building extensible payloads for effective attacks
      • Customizing exploits for defense bypass
  • Overview

    In this section, we analyze high-profile web application breaches, like the Dell customer portal attack, to understand the web application attacks that lead to massive data exposures. You will learn how attackers exploit flaws like forced browsing, insecure direct object references (IDOR), and command injection to access sensitive data. In the hands-on labs you will apply these attacks, equipping you with practical skills to detect and defend against them. From SQL injection to cross-site scripting, this module prepares you to secure your web applications against the tactics used in real-world breaches.

    Exercises
    • Forced Browsing and Insecure Direct Object Resource (IDOR) Attack
    • Command Injection Attack
    • Cross-Site Scripting Attack
    • SQL Injection Attack
    • Server-Side Request Forgery (SSRF) and Instance Metadata Service (IMDS) Attack
    • Cloud Bucket Discovery and Data Harvesting
    • Lightning Lab: Forced Browsing with Ffuf
    • Lightning Lab: Command Stacking
    Topics
    • Forced Browsing and IDOR
      • Public website attack chain assessment
      • Leveraging AI for identifying IDOR vulnerability patterns
      • Beyond crawling: accelerating discovery with attacker endpoint lists
    • Command Injection
      • Compromising websites with command injection
      • Walkthrough: Falsimentis community service website attack
      • Applying command injection in non-website targets
      • Attack access enumeration through command injection
      • Auditing web applications for command injection flaws
    • Cross-Site Scripting (XSS)
      • Exploiting victim browsers through server flaws
      • Classifying XSS types for opportunistic or target attacks
      • Cookie theft, password harvesting, and camera/microphone capture attacks
      • Using content security policies (CSP) to stop XSS
    • SQL Injection
      • Understanding SQL constructs and developer errors
      • Extracting data through SQL injection
      • Using Sqlmap to automate vulnerability discovery
      • SQL injection against cloud databases: Relational Database Service (RDS), Spanner, Azure SQL
    • Cloud Spotlight: SSRF and IMDS Attacks
      • Identifying server-side request forgery vulnerabilities
      • Understanding common requests vs. server-side requests
      • Walkthrough: Falsimentis federated SSO attack
      • Obtaining cloud keys through IMDS attacks
    • Cloud Spotlight: Insecure Storage
      • Case study: Cloud bucket storage exposure
      • Understanding cloud storage for Amazon Web Services, Azure, and Google Compute
      • Discovering insecure bucket storage
      • Walkthrough: Insecure storage to website persistence compromise
      • Identifying insecure cloud storage access
  • Overview

    Building on password, public-facing, and drive-by attacks, we'll dive into post-exploitation tactics where attackers bypass endpoint protection and use their foothold to access internal networks. You'll learn how privileged insider attacks work, how attackers establish persistence, and how they scan for and exfiltrate sensitive data. We'll also assess the security of vulnerable cloud deployments using automated tools and visualization techniques. You'll use these analysis skills to recognize and respond to these advanced threats, preparing you to apply what you've learned in real-world scenarios. Finally, we'll look at the steps to take after the course is over, turning what you've learned into long-term skills and helping you prepare for the certification exam.

    Exercises
    • Endpoint Protection Bypass: Bypassing Application Allow Lists
    • Pivoting and Lateral Movement with Command & Control Frameworks
    • Exploiting Windows as A Network Insider with Responder
    • Establishing Persistence with Metasploit
    • Network Threat Hunting with Real Intelligence Threat Analytics (RITA)
    • Cloud Configuration Assessment with ScoutSuite
    • Building Review Cards with Anki
    • Lightning Lab: Linux Privilege Escalation with Sudo
    • Lightning Lab: Generating Zeek Logs
    Topics
    • Endpoint Security Bypass
      • Understanding the three techniques for endpoint bypass
      • Evading application safelist controls
      • Using signed executables to evade endpoint controls
      • Using Microsoft-signed tools to attack systems: Living Off the Land (LOL)
      • Getting the most value from Endpoint Detection and Response (EDR/XDR) platforms
    • Pivoting and Lateral Movement
      • Using Metasploit features for lateral movement
      • Attacker detection evasion through pivoting
      • Using Linux and Windows features for advanced exploitation
      • Command & Control (C2) for privileged internal access
    • Hijacking Attacks
      • Exploiting privileged LAN access
      • Attacking default Windows vulnerable protocols
      • Password harvesting on the LAN
    • Establishing Persistence
      • Windows Management Instrumentation (WMI) Event Subscription persistence techniques
      • Exploiting Windows Active Directory: Golden Ticket attacks
      • Web shell access and multi-platform persistence
      • Cloud keys and backdoor accounts in Azure, Amazon Web Services, and Google Compute
    • Defense Spotlight: Real Intelligence Threat Analytics
      • Threat hunting through network analysis
      • Identifying beacons and C2 on your network
      • Characterizing network oddities: Long connections
      • Catching DNS exfiltration and access attacks
    • Cloud Spotlight: Cloud Post-Exploitation
      • Privilege enumeration and escalation in cloud environments
      • Identifying stealthy backdoors in Azure
      • Using Pacu as a cloud attack framework
      • Case study: Access to database dumping in Google Compute
      • Built-in tools for data access: Microsoft 365 Compliance Search
      • Assessing your cloud deployment for vulnerabilities
    • Where to Go from Here
      • Tips for developing long-term recall and memory retention
      • Applying spaced repetition theory using Anki
      • Staying motivated and finding time for skill development
      • Recommendations for passing your certification exam
  • Overview

    Our Capture-the-Flag event is a full day of hands-on activity that has you working as a consultant for ISS Playlist, a fictitious company that has recently been compromised. You will apply all the skills you've learned in class, using the same techniques used by attackers to compromise modern, sophisticated network environments. You will work on a team or independently to scan, exploit, and complete post-exploitation tasks against a cyber range of target systems including Windows, Linux, Internet of Things (IoT) devices, and cloud targets. This hands-on challenge is designed to help you practice your skills and reinforce the concepts learned throughout the course. With an integrated hint system to give you the on-demand guidance you need to succeed, the event guides you through the steps to successfully compromise target systems, bypass endpoint protection platforms, pivot to internal network high-value hosts, and exfiltrate company data.

    Topics
    • Target Discovery and Enumeration
    • Applying Open-Source Intelligence and Reconnaissance Information-Gathering
    • Public-Facing Asset Compromise
    • Email Compromise
    • Attacking Windows Active Directory
    • Password Spray, Guessing, and Credential Stuffing Attacks
    • Post-Exploitation Pivoting and Lateral Movement
    • Choosing, Configuring, and Delivering Exploits
    • Internal Attacker Compromise Attribution

GIAC Certified Incident Handler

The GIAC Incident Handler (GCIH) certification validates a practitioner's ability to detect, respond, and resolve computer security incidents using a wide range of essential security skills. GCIH certification holders have the knowledge needed to manage security incidents by understanding common attack techniques, vectors and tools, as well as defend against and respond to such attacks when they occur.

  • Incident Handling and Computer Crime Investigation
  • Computer and Network Hacker Exploits
  • Hacker Tools (Nmap, Metasploit and Netcat)
More Certification Details

Laptop Requirements

Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

It is critical that you back-up your system before class. It is also strongly advised that you do not bring a system storing any sensitive data.

CPU
  • 64-bit Intel i5/i7 2.0+ GHz processor
  • CRITICAL NOTE: Apple Silicon devices cannot perform the necessary virtualization and therefore cannot be used for this course.
  • Your system's processor must be a 64-bit Intel i5 or i7 2.0 GHz processor or higher. To verify on Windows 10 and 11, press Windows key + "I" to open Settings, then click "System", then "About". Your processor information will be listed near the bottom of the page. To verify on a Mac, click the Apple logo at the top left-hand corner of your display and then click "About this Mac".
BIOS
  • Enabled "Intel-VT"
  • Intel's VT (VT-x) hardware virtualization technology must be enabled in your system's BIOS or UEFI settings. You must be able to access your system's BIOS to enable this setting in order to complete lab exercises. If your BIOS is password-protected, you must have the password. This is absolutely required.
RAM
  • 16 GB RAM is highly recommended for the best experience. To verify on Windows 10 and 11, press Windows key + "I" to open Settings, then click "System", then "About". Your RAM information will be toward the bottom of the page. To verify on a Mac, click the Apple logo at the top left-hand corner of your display and then click "About this Mac".
Hard Drive Free Space
  • 100 GB of FREE space on the hard drive is critical to host the VMs and additional files we distribute. SSD drives are also highly recommended, as they allow virtual machines to run much faster than mechanical hard drives.
Operating System
  • Your system must be running either the latest version of Windows 10 and 11, macOS 10.15.x or later, or Linux that also can install and run VMware virtualization products described below.
Additional Software Requirements

VMware Player Install

  • Download and install VMware Workstation Pro 17+ (for Windows hosts), or VMWare Fusion Pro 13+ (for macOS hosts) prior to class beginning. Workstation Pro and Fusion Pro are now available free for personal use from the VMware website. Licensed commercial subscriptions to these products can also be used.
  • Other virtualization products, such as Hyper-V and VirtualBox, are not supported and will not work with the course material.

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

If you have additional questions about the laptop specifications, please contact customer service.

Author Statement

"Attacker tools and techniques have changed, and we need to change our incident response techniques to match. Since I took over as author of SEC504™ training in 2019, I have rewritten the entire course to give you the skills you need to succeed at incident response. Whether the attacks are Windows-focused or involve attacking critical application platforms or exploiting cloud vulnerabilities, you'll be prepared to effectively identify the attack, minimize the impact, and respond efficiently. With your knowledge of hacker tools and techniques, and by using defense skills that dramatically improve security, you will be ready to become the subject-matter expert your organization needs to meet today's cyber threats."

- Joshua Wright

"Our instructor Josh was incredible! Engaging, enthusiastic, extremely knowledgeable (especially vim, WOW). His enthusiasm is contagious and really motivating to the material. Keep up the great work Josh!" - Jen F., US Federal Agency

Reviews

SEC504™ is a great course and well-organized. The labs are amazing and well-tailored to learning the content. This is my first SANS training course and I am simply amazed at the content thus far. Greatly enjoying it!
Alex Colclough
Clayton Homes
SEC504™ has been the single best course I have ever taken. It leaves the student prepared and able to understand a broad scope of content in security.
Joshua Nielson
Microsoft
Great content! As a developer it is extremely useful to understand exploits and how better coding practices help your security position.
Jeremy Bramson
Bramson Welch & Associates
Incident response is the most underused aspect in small companies. SEC504™ gives us the ability to help management understand the value.
David Freedman
Nationwide Payment Solutions
(SEC504) is providing information that will help expand my security toolset and understand ways we can defend against the attacks we cover. This is very valuable experience to help me better perform my responsibilities.
Derek Dorman
Dayton Children's Hospital
There is no substitute for SEC504! This is a great course that will be extremely valuable for my role.
Robert Hooley
eHealth NSW

    Register for SEC504

    Learn about Group Pricing

    Prices below exclude applicable taxes and shipping costs. If applicable, these will be shown on the last page of checkout.

    Loading...