SEC504: Hacker Tools, Techniques, and Incident Handling

Overview

The first section of SEC504 training focuses on how to develop and build an incident response process in your organization. You’ll learn how to apply the Dynamic Approach to Incident Response (DAIR) process to effectively verify, scope, contain, assess, and remediate threats. We’ll apply this process in-depth with hands-on labs and examples from real-world compromises using PowerShell and other valuable analysis tools. You’ll also learn how you can accelerate the incident analysis process without sacrificing accuracy using generative AI platforms.

Full Lab Details

• Live Windows examination
• Network investigation
• Memory investigation
• Malware investigation
• Lightning Lab: WordPress Log Assessment
• Lightning Lab: Generating Zeek Logs
• Lightning Lab: Tcpdump Introduction
• Lightning Lab: Malware Strings

Full Topic Details

Incident Response

• Case study: Argous Corporation compromise
• Dynamic Approach to Incident Response
• Investigative analysis: Examining incident evidence
• Leveraging multiple evidence sources for incident analysis

Live Examination

• Using PowerShell for Windows threat hunting
• Identifying suspicious Windows processes
• Correlating network and persistence activity
• Assessing file-less malware threats
• Enumerating Windows auto-start extensibility points
• Leveraging Sysinternals for live Windows examinations

Network Investigations

• Identifying compromised host beaconing with proxy server logs
• Using Network Detection and Response (NDR) tools for threat hunting
• Filtering network activity to identify indicators of compromise
• Assessing encrypted network traffic with multiple data sources
• Building the incident timeline

Malware Investigations

• Assessing attacker malware in a safe test environment
• Using snapshot and continuous recording tools
• Inspecting malware actions with RegShot and Procmon
• Identifying malicious code on Windows

AI Spotlight: Accelerating IR with Generative AI

• Summarizing malicious code artifacts for reporting
• Essential prompt engineering tips
• Automating data deobfuscation with AI
• Effective logging data analysis with AI
• Tips for AI training for superior prompt results
• Writing incident response playbooks with AI
• Recognizing and mitigating the risks of AI-assisted incident response

Bootcamp: Linux Olympics

• Learn Linux using an interactive learning environment
• Build command line skills at your own pace
• Working with Linux file systems and permissions
• Using JQ to parse and filter JSON data
• Using file parsing tools, including grep, cut, and awk
• Linux compromise incident response walkthrough

Bootcamp: PowerShell Olympics

• Learn PowerShell on Windows using an interactive learning environment
• Build command line skills at your own pace
• Get started with PowerShell skills: cmdlets, functions, built-ins, and more!
• Learn to quickly interrogate a Windows system for effective threat hunting
• Accelerate your common analysis tasks with PowerShell automation

Overview

In this course section, we’ll look at the techniques attackers use to conduct reconnaissance as a pre-attack step, including how they use open-source intelligence, network scanning, and target enumeration to find attack opportunities. You’ll use attacker techniques to assess the security of target networks, evaluating popular protocols and endpoints for Windows, Linux, Azure, and AWS targets. After delivering the attacks, you’ll investigate the logging data and evidence that remains to recognize these attacks as they happen.

Full Lab Details

• Host Discovery and Assessment with Nmap
• Shadow Cloud Asset Discovery with Masscan
• Windows Server Message Block (SMB) Security Investigation
• Windows Password Spray Attack Detection
• The Many Uses of Netcat
• Lightning Lab: Nmap Port Ranges
• Lightning Lab: Scanning with SMBeagle
• Lightning Lab: SMB Client Access
• Lightning Lab: Netcat Client Features

Full Topic Details

MITRE ATT&CK® Framework Introduction

• Using ATT&CK to guide an incident response investigation
• Staying current with changing attack techniques
• Leveraging ATT&CK for threat intelligence

Network and Host Scanning with Nmap

• Host enumeration and discovery with Nmap
• Internal and external network mapping and visualization
• Minimizing network activity to avoid detection
• Deep host assessment with Nmap Scripting Engine tools

Cloud Spotlight: Cloud Scanning

• Accelerating scans with Masscan
• Walkthrough: Scanning Amazon Web Services for target discovery
• Attributing cloud hosts to a target organization
• Visualizing targets with EyeWitness

Server Message Block (SMB) Security

• Understanding Windows SMB: Essential skill development
• Identifying SMB attacks against Windows
• Using built-in tools for SMB password attacks
• Understanding SMB security features
• Exploiting SMB vulnerabilities like an attacker

Defense Spotlight: Hayabusa and Sigma Rules

• Identifying attacks using Windows Event Logs and Hayabusa
• Threat hunting using Sigma rules
• Differentiating attacks from false positives
• Remote host assessment for compromise identification
• Tips for fast assessment to begin incident analysis

Multi-purpose Netcat

• Data exfiltration while evading monitoring controls
• Internal network pivoting and lateral movement
• Implementing listener and reverse TCP backdoors on Linux and Windows
• Detailed look at attacker post-compromise techniques
• Living Off the Land (LOL) attacks to evade endpoint detection tools

Overview

Attackers tirelessly deploy password attacks and exploits to infiltrate systems, posing a constant threat to your organization’s systems. In this section, we explore multiple techniques for password compromises against on-premises and cloud systems. We’ll leverage popular attacks tools, including Legba for multi-protocol password attacks and Hashcat for cracking. We’ll also dive into exploits frameworks like Metasploit for initial and post-compromise exploitation. We will apply generative AI systems to accelerate attacks and find new ways to exploit systems. We use the insight we can gain from these tools to better implement practical defenses and to inform our incident response playbooks.

Full Lab Details

• Using Legba for Password Guessing and Spray Attacks
• Bypassing Microsoft 365 authentication defenses with Amazon AWS
• Password Cracking with Hashcat
• Metasploit Attack and Analysis
• Offensive AI Attacks
• Lightning Lab: Password List Filtering
• Lightning Lab: Hashcat Hash Types
• Lightning Lab: Using Hashcat Rules
• Lightning Lab: Metasploit Searching

Full Topic Detail

Password Attacks

• Password attack trifecta: Guessing, spray, and credential stuffing
• Accelerating password attacks with Legba
• Techniques for bypassing password attack defenses
• Understanding real-world authentication attacks

Microsoft 365 Attacks

• Enumerating valid Microsoft 365 user accounts
• Assessing and bypassing Multi-Factor Authentication (MFA)
• Attacking cloud Software as a Service (SaaS) platforms
• Leveraging AWS services to bypass account lockout
• Differentiating Azure Gov Cloud and enterprise cloud security
• Investigating business email compromise

Understanding Password Hashes

• Weaknesses in Windows password hash formats
• Collecting password hashes in Windows, Linux, and cloud targets
• Mitigating GPU-based password cracking with Yescrypt and Argon2

Password Cracking

• Recovering passwords from hashes with Hashcat
• Accelerating password cracking with GPUs and cloud assets
• Effective cracking with password policy masks
• Multi-factor authentication and password cracking implications

Metasploit Framework

• Using Metasploit to identify, configure, and deliver exploits
• Selecting payloads that grant access while evading defenses
• Establishing and using Command & Control (C2) victim access
• Identifying Metasploit and Meterpreter artifacts for incident response

AI Spotlight: Offensive AI

• Accelerating victim data analysis
• Predicting passwords using breach history
• Integrating attacks with AI using Model Context Protocol (MCP)
• Grounding attacker AI with Retrieval Augmented Generation (RAG)
• Bypassing AI guardrails
• Defending against offensive AI and automation

Overview

In this section, we analyze high-profile web application breaches, like the Dell customer portal attack, to understand the web application attacks that lead to massive data exposures. You will learn how attackers exploit flaws like forced browsing, insecure direct object references (IDOR), and command injections to access sensitive data. In the hands-on labs, you will apply these attacks, equipping you with practical skills to detect and defend against them. From SQL injection to cross-site scripting, this module prepares you to assess and secure modern web applications against the tactics used in real-world breaches.

Full Lab Details

• Forced Browsing and Insecure Direct Object Resource (IDOR) Attack
• Command Injection Attack
• Cross-Site Scripting Attack
• SQL Injection Attack
• Exploiting Vulnerable API Endpoints
• Cloud Bucket Discovery and Data Harvesting
• Lightning Lab: Forced Browsing with Ffuf
• Lightning Lab: Command Stacking

Full Topic Detail

Forced Browsing and IDOR

• Public website attack chain assessment
• Leveraging AI for identifying IDOR vulnerability patterns
• Beyond crawling: accelerating discovery with attacker endpoint lists

Command Injection

• Compromising websites with command injection
• Walkthrough: Falsimentis community service website attack
• Applying command injection in non-website targets
• Attack access enumeration through command injection
• Auditing web applications for command injection flaws

Cross-Site Scripting (XSS)

• Exploiting victim browsers through server flaws
• Classifying XSS types for opportunistic or target attacks
• Cookie theft, password harvesting, and camera/microphone capture attacks
• Using content security policies (CSP) to stop XSS

SQL Injection

• Understanding SQL constructs and developer errors
• Extracting data through SQL injection
• Using Sqlmap to automate vulnerability discovery
• SQL injection against cloud databases: Relational Database Service (RDS), Spanner, Azure SQL

API Attacks

• RESTful application design and vulnerabilities
• Enumerating API endpoints
• Exploring APIs with Bruno
• Exploiting API Vulnerabilities

Cloud Spotlight: Insecure Storage

• Case study: Cloud bucket storage exposure
• Understanding cloud storage for Amazon Web Services, Azure, and Google Compute
• Discovering insecure bucket storage
• Walkthrough: Insecure storage to website persistence compromise
• Identifying insecure cloud storage access

Overview

We’ll dive into post-exploitation tactics where attackers bypass endpoint protection and use their foothold to access internal networks. You’ll learn how privileged insider attacks work, how attackers establish persistence, and how they scan for and exfiltrate sensitive data. We’ll also assess the security of vulnerable cloud deployments using automated tools and visualization techniques. We’ll also look at common AI integration strategies and how attackers manipulate these systems through prompt injection. You’ll use these analysis skills to recognize and respond to these advanced threats, preparing you to apply what you’ve learned in real-world scenarios. Finally, we’ll look at the steps to take after the course is over, turning what you’ve learned into long-term skills and helping you prepare for the certification exam.

Full Lab Details

• Endpoint Protection Bypass: Bypassing Application Allow Lists
• Pivoting and Lateral Movement with Command & Control Frameworks
• Exploiting Windows as A Network Insider with Responder
• Establishing Persistence with Metasploit
• Learning Prompt Injection: Office Integration
• Building Review Cards with Anki
• Lightning Lab: Linux Privilege Escalation with Sudo

Full Topic Detail

Endpoint Security Bypass

• Understanding the three techniques for endpoint bypass
• Evading application safelist controls
• Using signed executables to evade endpoint controls
• Using Microsoft-signed tools to attack systems: Living Off the Land (LOL)
• Getting the most value from Endpoint Detection and Response (EDR/XDR) platforms

Pivoting and Lateral Movement

• Using Metasploit features for lateral movement
• Attacker detection evasion through pivoting
• Using Linux and Windows features for advanced exploitation
• Command & Control (C2) for privileged internal access

Hijacking Attacks

• Exploiting privileged LAN access
• Attacking default Windows vulnerable protocols
• Password harvesting on the LAN

Establishing Persistence

• Windows Management Instrumentation (WMI) Event Subscription persistence techniques
• Exploiting Windows Active Directory: Golden Ticket attacks
• Web shell access and multi-platform persistence
• Cloud keys and backdoor accounts in Azure, Amazon Web Services, and Google Compute

AI Spotlight: Prompt Injection Attack

• LLM prompt processing and guardrail processes
• AI integration scanning and reconnaissance
• Refusal suppression and format switching attacks
• Prompt encoding and mutation attacks
• Direct and indirect prompt injection attacks
• Prompt injection defense recommendations

Where to Go from Here

• Tips for developing long-term recall and memory retention
• Applying spaced repetition theory using Anki
• Staying motivated and finding time for skill development
• Recommendations for passing your certification exam

Overview

Our Capture-the-Flag event is a full day of hands-on activity that has you working as a consultant for ISS Playlist, a fictitious company that has recently been compromised. You will apply all the skills you've learned in class, using the same techniques used by attackers to compromise modern, sophisticated network environments. You will work on a team or independently to scan, exploit, and complete post-exploitation tasks against a cyber range of target systems including Windows, Linux, Internet of Things (IoT) devices, and cloud targets. This hands-on challenge is designed to help you practice your skills and reinforce the concepts learned throughout the course. With an integrated hint system to give you the on-demand guidance you need to succeed, the event guides you through the steps to successfully compromise target systems, bypass endpoint protection platforms, pivot to internal network high-value hosts, and exfiltrate company data.

Full Topic Detail

• Target Discovery and Enumeration
• Applying Open-Source Intelligence and Reconnaissance Information-Gathering
• Public-Facing Asset Compromise
• Business Email Compromise (BEC)
• Attacking Windows Active Directory
• Password Spray, Guessing, and Credential Stuffing Attacks
• Post-Exploitation Pivoting and Lateral Movement
• Choosing, Configuring, and Delivering Exploits
• Internal Attacker Compromise Attribution