Join us at SANS Secure March 2021
Secure Asia Pacific is a part of the Secure March 2021 event - our largest-ever regional online event with over 30 SANS Live Online Courses being presented on Asia Pacific-friendly time zones. You will be able to avail of all of our core courses as well as exciting new releases like SEC510: Multicloud Security Assessment and Defense, MGT516: Managing Security Vulnerabilities: Enterprise and Cloud and SEC588: Cloud Penetration Testing.
If you don't see the course you need at Secure Asia Pacific 2021 please check out the roster offered at our other Secure March events:
* Most classes at Secure Japan 2021 will be available in both English with Japanese language translation. Please contact us at AsiaPacific@sans.org for further information.
Associated Certification: GIAC Certified Forensic Analyst (GCFA)
ADVANCED THREATS ARE IN YOUR NETWORK - IT'S TIME TO GO HUNTING!
FOR508: Advanced Incident Response and Threat Hunting Course will help you to:
DAY 0: A 3-letter government agency contacts you to say an advanced threat group is targeting organizations like yours, and that your organization is likely a target. They won't tell how they know, but they suspect that there are already several breached systems within your enterprise. An advanced persistent threat, aka an APT, is likely involved. This is the most sophisticated threat that you are likely to face in your efforts to defend your systems and data, and these adversaries may have been actively rummaging through your network undetected for months or even years.
This is a hypothetical situation, but the chances are very high that hidden threats already exist inside your organization's networks. Organizations can't afford to believe that their security measures are perfect and impenetrable, no matter how thorough their security precautions might be. Prevention systems alone are insufficient to counter focused human adversaries who know how to get around most security and monitoring tools.
The key is to constantly look for attacks that get past security systems, and to catch intrusions in progress, rather than after attackers have completed their objectives and done significant damage to the organization. For the incident responder, this process is known as "threat hunting". Threat hunting uses known adversary behaviors to proactively examine the network and endpoints in order to identify new data breaches.
Threat hunting and Incident response tactics and procedures have evolved rapidly over the past several years. Your team can no longer afford to use antiquated incident response and threat hunting techniques that fail to properly identify compromised systems, provide ineffective containment of the breach, and ultimately fail to rapidly remediate the incident. Incident response and threat hunting teams are the keys to identifying and observing malware indicators and patterns of activity in order to generate accurate threat intelligence that can be used to detect current and future intrusions.
This in-depth incident response and threat hunting course provides responders and threat hunting teams with advanced skills to hunt down, identify, counter, and recover from a wide range of threats within enterprise networks, including APT nation-state adversaries, organized crime syndicates, and hacktivists. Constantly updated, FOR508: Advanced Incident Response and Threat Hunting addresses today's incidents by providing hands-on incident response and threat hunting tactics and techniques that elite responders and hunters are successfully using to detect, counter, and respond to real-world breach cases.
The course uses a hands-on enterprise intrusion lab -- modeled after a real-world targeted APT attack on an enterprise network and based on APT group tactics to target a network -- to lead you to challenges and solutions via extensive use of the SIFT Workstation and best-of-breed investigative tools.
During the intrusion and threat hunting lab exercises, you will identify where the initial targeted attack occurred and how the adversary is moving laterally through multiple compromised systems. You will also extract and create crucial cyber threat intelligence that can help you properly scope the compromise and detect future breaches.
During a targeted attack, an organization needs the best incident response team in the field. FOR508: Advanced Incident Response and Threat Hunting will train you and your team to respond, detect, scope, and stop intrusions and data breaches.
GATHER YOUR INCIDENT RESPONSE TEAM - IT'S TIME TO GO HUNTING
FOR508 Course Topics
Hands-On Training
One of the biggest complaints you hear in the threat hunting and incident response community is the lack of realistic intrusion data. Most real-world intrusion data are simply too sensitive to be shared.
The FOR508 course authors created a realistic scenario based on experiences surveyed from a panel of responders who regularly combat targeted APT attacks. They helped review and guide the targeted attack "script" used to create the scenario. The result is an incredibly rich and realistic attack scenario across multiple enterprise systems. This APT attack lab forms the basis for training during the week. The network was set up to mimic a standard "protected" enterprise network using standard compliance checklists:
This exercise and challenge are used to show real adversary traces across host systems, system memory, hibernation/pagefiles, and more:
You Will Be Able To
What You Will Receive
Notice:
Please plan to arrive 30 minutes early on Day 1 for lab preparation and set-up.
There are ways to gain an advantage against adversaries targeting you -- it starts with the right mindset and knowing what works.
The last decade has not been kind to network defenders. Threats to the modern enterprise are legion and attackers have used the enormous complexity of enterprise networks against us. But the tide is shifting. Over the past decade, we have seen a dramatic increase in sophisticated attacks against organizations. Nation-state attacks originating from the intelligence services of countries like China and Russia, often referred to as Advanced Persistent Threat (APT) actors, have proved difficult to suppress. Massive financial attacks from the four corners of the globe have resulted in billions of dollars in losses. Ransomware and extortion became an existential threat almost overnight. While the odds are stacked against us, the best teams out there are proving that these threats can be managed and mitigated. The adversary is good and getting better. Are we learning how to counter them? Yes, we are.
This course was designed to help organizations increase their capability to detect and respond to intrusions. This is an achievable goal and begins by teaching you the tools and techniques necessary to find evil in your network. This course is designed to make you and your organization an integral part of the solution. Incident responders and threat hunters must be armed with the latest tools, analysis techniques, and enterprise methodologies to identify, track, and contain advanced adversaries with the ultimate goal of rapid remediation of incidents. Further, incident response and threat hunting analysts must be able to scale their efforts across potentially thousands of systems in the enterprise. We start the day by examining the six-step incident response methodology as it applies to incident response for advanced threat groups. The importance of developing cyber threat intelligence to impact the adversaries' "kill chain" is discussed and forensic live response techniques and tactics are demonstrated that can be applied both to single systems and across the entire enterprise.
Understanding attacks is critical to being able to detect and mitigate them. We start our education of attacker techniques on day one, learning common malware characteristics and diving deep into techniques used by adversaries to maintain persistence in the network. Persistence is typically completed early in the attack cycle and students will learn hunting techniques to audit the network and accomplish early discovery. Living off the land binaries (local tools available in most environments) and WMI-based attacks in particular have become standard operating procedure for advanced adversaries and we end the day working with tools and techniques to identify such attacks at scale.
Get ready to hunt!
CPE/CMU Credits: 6
Real Incident Response Tactics
Threat Hunting
Threat Hunting in the Enterprise
Incident Response and Hunting across Endpoints
Malware Defense Evasion and Identification
Malware Persistence Identification
Investigating WMI-Based Attacks
Even the most advanced adversaries leave footprints everywhere. Learn the secrets of the best hunters.
Cyber defenders have a wide variety of tools and artifacts available to identify, hunt, and track adversary activity in a network. Each attacker action leaves a corresponding artifact, and understanding what is left behind as footprints can be crucial to both red and blue team members. Attacks follow a predictable pattern, and we focus our detective efforts on immutable portions of that pattern. As an example, at some point an attacker will need to run code to accomplish their objectives. We can identify this activity via application execution artifacts. The attacker will also need one or more accounts to run code. Consequently, account auditing is a powerful means of identifying malicious actions. An attacker also needs a means to move throughout the network, so we look for artifacts left by the relatively small number of ways there are to accomplish this part of their mission. In this section, we cover common attacker tradecraft and discuss the various data sources and forensic tools you can use to identify malicious activity in the enterprise.
CPE/CMU Credits: 6
Stealing and Utilization of Legitimate Credentials
Advanced Evidence of Execution Detection
Lateral Movement Adversary Tactics, Techniques, and Procedures (TTPs)
Log Analysis for Incident Responders and Hunters
Using memory analysis sometimes feels like cheating -- finding active attacks shouldn't be this easy.
Memory forensics has come a long way in just a few years. It is now a critical component of many advanced tool suites and the mainstay of successful incident response and threat hunting teams. Memory forensics can be extraordinarily effective at finding evidence of worms, rootkits, PowerShell, and advanced malware used by targeted attackers. In fact, some fileless attacks may be nearly impossible to unravel without memory analysis. Memory analysis was traditionally the domain of Windows internals experts and reverse engineers, but new tools, techniques, and detection heuristics have greatly leveled the playing field making it accessible today to all investigators, incident responders, and threat hunters. Further, understanding attack patterns in memory is a core analyst skill applicable across a wide range of endpoint detection and response (EDR) products, making those tools even more effective. This extremely popular section will cover many of the most powerful memory analysis capabilities available and give you a solid foundation of advanced memory forensic skills to super-charge investigations, regardless of the toolset employed.
CPE/CMU Credits: 6
Remote and Enterprise Incident Response
Triage and Endpoint Detection and Response (EDR)
Memory Acquisition
Memory Forensics Analysis Process for Response and Hunting
Memory Forensics Examinations
Memory Analysis Tools
Students will receive a full six-month license of F-Response Enterprise Edition, enabling them to use their workstation or the SIFT workstation to connect and script actions on hundreds or thousands of systems in the enterprise. This capability is used to benchmark, facilitate, and demonstrate new incident response and threat hunting technologies that enable a responder to look for indicators of compromise across the entire enterprise network in memory and on disk.
Timeline analysis will change the way you approach digital forensics, threat hunting, and incident response...forever.
Learn advanced incident response and hunting techniques uncovered via timeline analysis directly from the authors who pioneered timeline analysis tradecraft. Temporal data is located everywhere on a computer system. Filesystem modified/access/creation/change times, log files, network data, registry data, and browser history files all contain time data that can be correlated and analyzed to rapidly solve cases. Pioneered by Rob Lee as early as 2001, timeline analysis has grown to become a critical incident response, hunting, and forensics technique. New timeline analysis frameworks provide the means to conduct simultaneous examinations on a multitude of systems across a multitude of forensic artifacts. Analysis that once took days now takes minutes.
This section will step you through two primary methods of building and analyzing timelines used during advanced incident response, threat hunting, and forensic cases. Exercises will show analysts how to create timelines and how to introduce the key analysis methods necessary to help you use those timelines effectively in your cases.
CPE/CMU Credits: 6
Malware Defense Evasion and Detection
Timeline Analysis Overview
Filesystem Timeline Creation and Analysis
Super Timeline Creation and Analysis
Advanced adversaries are good. We must be better.
Attackers commonly take steps to hide their presence on compromised systems. While some anti-forensics steps can be relatively easy to detect, others are much harder to deal with. As such, it's important that forensic professionals and incident responders are knowledgeable on various aspects of the operating system and file system which can reveal critical residual evidence. In this section, we focus primarily on the file system to recover files, file fragments, and file metadata of interest to the investigation. These trace artifacts can help the analyst uncover deleted logs, attacker tools, malware configuration information, exfiltrated data, and more. This often results in a deeper understanding of the attacker TTPs and provides more threat intelligence for thorough scoping the intrusion. In some cases, these deep-dive techniques could be the only means for proving that an attacker was active on a system of interest.
CPE/CMU Credits: 6
Volume Shadow Copy Analysis
Advanced NTFS Filesystem Tactics
Advanced Evidence Recovery
This incredibly rich and realistic enterprise intrusion exercise is based on a real-world advanced persistent threat (APT) group. It brings together techniques learned earlier in the course and tests your newly acquired skills in an investigation into an attack by an advanced adversary. The challenge brings it all together using a real intrusion into a complete Windows enterprise environment. You will be asked to uncover how the systems were compromised in the initial intrusion, find other compromised systems via adversary lateral movement, and identify intellectual property stolen via data exfiltration. You will walk out of the course with hands-on experience investigating a real attack, curated by a cadre of instructors with decades of experience fighting advanced threats from attackers ranging from nation-states to financial crime syndicates and hacktivist groups.
CPE/CMU Credits: 6
IDENTIFICATION AND SCOPING:
1. How and when did the APT group breach our network?
2. List all compromised systems by IP address and specific evidence of compromise.
3. When and how did the attackers first laterally move to each system?
CONTAINMENT AND THREAT INTELLIGENCE GATHERING:
4. How and when did the attackers obtain domain administrator credentials?
5. Once on other systems, what did the attackers look for on each system?
6. Find exfiltrated email from executive accounts and perform damage assessment.
7. Determine what was stolen: Recover any attacker archives, find encryption passwords, and extract the contents to verify exfiltrated data.
8. Collect and list all malware used in the attack.
9. Develop and present cyber threat intelligence based on host and network indicators of compromise.
REMEDIATION AND RECOVERY:
10. What level of account compromise occurred. Is a full password reset required during remediation?
11. Based on the attacker techniques and tools discovered during the incident, what are the recommended steps to remediate and recover from this incident?
a. What systems need to be rebuilt?
b. What IP addresses need to be blocked?
c. What countermeasures should we deploy to slow or stop these attackers if they come back?
d. What recommendations would you make to detect these intruders in our network again?
ADDITIONAL NOTES:
If you have attended FOR500, you may want to bring your copy of the FOR500 - Windows SIFT Workstation Virtual Machine, as you can use it for the final challenge and for many of the exercises in FOR508.
Bring/install any other forensic tool you feel could be useful (Splunk, EnCase, FTK, etc). For the final challenge at the end of the course, you can utilize any forensic tool to help you and your team perform the analysis, including commercial capabilities. If you have any dongles, licensed software, etc., you are free to use them.
Please do not plan to use the version of the SIFT Workstation downloaded from the Internet. We will provide you with a version specifically configured for the FOR508 materials on Day 1 of the course.
If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.
Important! Bring your own system configured according to these instructions!
A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.
This is common sense, but we will say it anyway. Back up your system before class. Better yet, do not have any sensitive data stored on the system. SANS can't responsible for your system or data.
MANDATORY FOR508 SYSTEM HARDWARE REQUIREMENTS:
BIOS settings must be set to enable virtualization technology, such as "Intel-VT".
Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary. Test it!
MANDATORY FOR508 HOST OPERATING SYSTEM REQUIREMENTS:
Please note: It is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.
PLEASE INSTALL THE FOLLOWING SOFTWARE PRIOR TO CLASS:
Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.
SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.
If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.
Who Should Attend
FOR508 is an advanced incident response and threat hunting course that focuses on detecting and responding to advanced persistent threats and organized crime threat groups. We do not cover the introduction or basics of incident response, Windows digital forensics, or hacker techniques in this course.
We recommend that you should have a background in FOR500: Windows Forensics prior to attending this course.
"THIS WAS PROBABLY THE MOST COMPREHENSIVE AND USEFUL OF ALL THE TRAINING I HAVE EVER RECEIVED BY SANS." - DoD Student, USAF
"THE SANS508 COURSE EXCEEDED MY EXPECTATIONS IN EVERY WAY. IT PROVIDED ME THE SKILLS, KNOWLEDGE, AND TOOLS TO EFFECTIVELY RESPOND TO AND HANDLE APTS AND OTHER ENTERPRISE WIDE THREATS." -Josh Moulin NSTEC/NNSA/DOE
"THE EXAMPLES IN THE COURSE RELATE TO WHAT I NEED TO KNOW TO DEAL WITH REAL WORLD THREATS." -Tim Weaver, Digital Mtn. Inc.
"I WAS SURPRISED AND AMAZED AT HOW EASY IT IS TO DO MEMORY ANALYSIS AND HOW HELPFUL IT IS." - Brian Dugay, Apple
"THE LEVEL OF DETAIL IS AMAZING. THE METHODOLOGY IS CLEARLY EFFECTIVE AT FINDING PERTINENT ARTIFACTS." - Anonymous
"I'VE TAKEN OTHER NETWORK INTRUSION CLASSES BUT NOTHING THIS IN-DEPTH. THE CLASS IS OUTSTANDING!" - Craig Goldsmith, FBI
"CUTTING EDGE EXPERTISE TAUGHT BY WORLD CLASS EXPERTS." -Joseph Murray, Deloitte
"I AM A DIFFERENT MAN AS A RESULT OF THIS COURSE." - Travis Farral, XTO Energy
"ABSOLUTELY ESSENTIAL KNOWLEDGE. TRADITIONAL KNOWLEDGE IS USEFUL, BUT THIS COURSE PROVIDES THE PRACTICAL SIDE OF A GROWING TREND." -Erik Musick, Arkansas State Police
"THIS IS A GREAT CLASS AND SHOULD BE MANDATORY FOR ANYONE IN THE FORENSIC FIELD. GREAT JOB, ROB!" -Mark Merchant, State of Alaska/State Security Office
"COME PREPARED TO LEARN A LOT." -Todd Black Lee, The Golden 1 Credit Union
"YOU CAN DELETE IT, HIDE IT, RENAME IT, BUT WE WILL FIND IT." -Edward Fuller, Department of Defense
"GREAT COURSE! THIS NOT ONLY HELPS ME IN FORENSICS BUT ALSO IN CREATING USE-CASES FOR OUR OTHER INTRUSION ANALYSIS TOOLS." -Joseph Murray, Deloitte
"IT IS HARD TO REALLY SAY SOMETHING THAT WILL PROPERLY CONVEY THE AMOUNT OF MENTAL GROWTH I HAVE EXPERIENCED THIS WEEK." -Travis Farral, XTI Energy
"EXCELLENT COURSE, INVALUABLE HANDS-ON EXPERIENCE TAUGHT BY PEOPLE WHO NOT ONLY KNOW THE TOOLS AND TECHNIQUES, BUT KNOW THEIR QUIRKINESS THROUGH PRACTICAL, REAL-WORLD EXPERIENCE." -John Alexander, US Army
"THIS COURSE (FOR508) REALLY TAKES YOU FROM 0-60 IN UNDERSTANDING THE CORE CONCEPTS OF FORENSICS, ESPECIALLY THE FILE SYSTEM." -Matthew Harvey, U.S. Department of Justice
"IF YOU NEED TO TRACK DOWN WHAT HAPPENED IN YOUR ENVIRONMENTS, THIS IS A MUST HAVE COURSE!" -Fran Moniz, American National Insurance
"THE CAPSTONE EXERCISE IS AWESOME, PUTS TRACKING THE APT INTO PRACTICE." -Gavin Worden, SD-LECC
"BEST FORENSICS TRAINING I'VE HAD SO FAR. I THOUGHT THE SOME OTHERS COURSES WERE GREAT BUT 508 IS A LOT MORE CURRENT AND APPLICABLE TO THE REAL WORLD! EXCELLENT COURSE AND INSTRUCTOR OVERALL!" -Marc Bleicher, Bit9
"THE MORE I PROGRESS THROUGH THE COURSE, THE MORE I REALIZE JUST HOW MUCH CAPACITY THERE IS TO PRODUCE ANSWERS TO TOUGH QUESTIONS. WHERE I MIGHT NOT HAVE FOUND SUPPORTING EVIDENCE IN PAST CASES, I FEEL I HAVE SO MANY NEW AVENUES TO EXPLORE. A REAL EYE-OPENER. I ALSO GREATLY APPRECIATE THE FOCUS ON INCIDENT RESPONSE." - Dave Ockwell-Jenner, SITA
"I HAVE ALREADY USED SEVERAL OF THE TOOLS/TECHNIQUES FROM THE COURSE WITH PAST-CASE EVIDENCE TO UNCOVER THINGS I DID NOT PREVIOUSLY KNOW." - Dave Ockwell-Jenner, SITA
"MY SOC FOCUSES A LOT ON INCIDENT RESPONSE AND QUICK FORENSICS, SO THE COURSE MATERIAL IS EXTREMELY VALUABLE." - Anonymous
"I ROUTINELY PERFORM LIVE MEMORY CAPTURES AND HAVE GONE THROUGH THEM LOOKING FOR THE OBVIOUS, BUT I HAD NO IDEA, UNTIL FOR508, HOW MANY ARTIFACTS ARE CONTAINED IN RAM." - M Scott Saul, FBI
"THE SANS INSTITUTE IS CURRENTLY THE LEADER IN THE COMMERCIAL IR AND COMPUTER FORENSIC TRAINING MARKET. THEY HAVE A LARGE NUMBER OF QUALITY COURSES." - Luttgens, Jason; Pepe, Matthew; Mandia, Kevin. Incident Response & Computer Forensics, Third Edition - July 2014
"YOU HAVE THE CONTENT WHICH IS CLOSE TO REAL WHEN YOU HAVE THE INSTRUCTOR THAT GOES INTO A LOT OF REAL WORLD EXAMPLES. JUST GREAT." - Anonymous
"FOR508 COMBINED WITH FOR572 SHOWS A COMPLETE PICTURE FROM DISK SIDE TO NETWORK SIDE." - Dow Shirley, Energy Solutions
"MOST IN-DEPTH, STATE OF THE ART IR COURSE I CAN IMAGINE. FIRST TIME I THINK DEFENSE CAN ACTUALLY GAIN AN ADVANTAGE. THANK YOU." - Kai Thomsen, AUDI AG
FULL REVIEW AND WRITE UP OF FOR508 BY DAVID NIDES, KPMG-
PRESS ARTICLES ABOUT THE NEW FOR508 COURSE:
Should I take SANS 408 or 508? (part 1) - http://digitalforensicstips.com/category/training_reviews/
SANS 508 Compared to 408 Part Two (part 2) - http://digitalforensicstips.com/2013/04/sans-508-compared-to-408-part-two-plus-a-side-of-610/
"In describing the advanced persistent threat (APT) and advanced adversaries, many experts have said, 'There are people smarter than you, who have more resources than you, and who are coming for you. Good luck with that.' They were not joking. The results over the past several years clearly indicate that hackers employed by nation-states and organized crime are racking up success after success. The APT has compromised hundreds of organizations. Organized crime organizations using botnets are exploiting Automated Clearing House (ACH) fraud daily. Similar groups are penetrating banks and merchants, stealing credit card data. Fortune 500 companies are beginning to detail data breaches and hacks in their annual stockholder reports.
"In other words, the enemy is getting better and bolder, and their success rate is impressive.
"We can stop them, but to do so, we need to field more sophisticated incident responders and digital forensics investigators. We need lethal digital forensics experts who can detect and eradicate advanced threats immediately. A properly trained incident responder could be the only defense your organization has left during a compromise. Forensics 508: Advanced Digital Forensics, Incident Response, and Threat Hunting is crucial training for you to become the lethal forensicator who can step up to these advanced threats. The enemy is good. We are better. This course will help you become one of the best."
- Rob Lee
"We live in a world of unimaginable amounts of data stored on immensely large and complicated networks. Our adversaries use this complexity against us to slice through our defenses and take virtually anything they want, anytime they want it. While this is our current state, it will not be our future. Incident response is at an inflection point. Old models are being upgraded to make defenders more effective and nimble in response to more sophisticated and aggressive attackers. The most successful incident response teams are evolving rapidly due to near-daily interaction with adversaries. New tools and techniques are being developed, providing better visibility and making the network more defensible. There are an increasing number of success stories, with organizations quickly identifying intrusions and rapidly remediating them.
We created this course to build upon those successes. Like the field itself, the course is continuously updated, bringing the latest advances into the classroom. Whether you are just moving into the incident response field or are already leading hunt teams, FOR508 facilitates learning from others' experiences and develops the necessary skills to take you to the next level."
- Chad Tilbury