Search

Talk With an Expert

Talk With an Expert

Resources2

Show:

Sort by:

Resources (2)

Webinar
SANS Security West 2023 - Hands-On Workshop: Building Detections in Azure
This is a 2-hour hands-on workshop. As with any enterprise environment, we can (and should) focus on hardening our defenses to keep the adversaries out, but these defenses may some day be evaded via a variety of methods. Cloud is no different. In this workshop, which is a follow-on from the talk “Building Better Cloud Detections... By Hacking? (Azure Edition)“, we will work through the process of creating a detection that we can use as defenders to spot an adversary performing attack techniques against our Azure environments. The overall process and takeaways will be:- Establish proper logging to detect the adversarial activity- Perform the attack to generate the appropriate artifacts- Review the log event data- Create an automated process to quickly discover this activity- Test that the automated process is working effectively by “re-attacking” the Azure accountPrerequisites: An Azure account with administrator accessSystem Requirements: A modern web browser
Webinar
SANS Pen Test Austin 2023: Workshop - Building Azure Security Labs using Terraform
The increased importance of the cloud and identity is not lost on attackers. To simulate adversary tradecraft, Red teams must be able to evolve offensive techniques against cloud identity systems. Cloud defenders must adapt quickly to understand these same attacks and instrument defenses. In this SANS Workshop, students will be introduced to the PurpleCloud open-source Azure lab creation tool. Students will learn how to use Terraform to automatically create an Azure Active Directory security lab which can be used for your own security simulations. After automatically creating Azure AD users, Applications, and RBAC role assignments, participants will have hands-on exercises to perform reconnaissance and a specific attack pathway that abuses mis-configured roles and permissions. This workshop is intended for Cloud Architects, Security Engineers, Penetration Testers, Defenders, and anyone looking to learn a little more Azure and Terraform. Prerequisites: • An active Azure subscription (https://portal.azure.com) • An Azure account with Global Administrator permissions Prior to the workshop: 1. Download the Building Azure Security Labs using Terraform virtual machine. Double-click on the OVA file to import the VM with VMware. Boot the VM after import, then login with the username sec588 and the password slingshot. https://sansurl.com/building-azure-labsPassword: jaJDY8hu44b32. Launch Firefox browser and navigate to home (it should auto-launch). 3. Follow the lab 0 instructions to ensure that you have an Azure account and active subscription.4. The Workshop instructions are also available at https://lab.purplecloud.network with the following credentials sec588:sec588 Please note – we will not be able to troubleshoot or support local VM issues or Azure account subscription issues. It is highly encouraged that you download and verify login to the VM before the workshop and that you follow all steps in lab 0 for Azure account and subscription setup. System Requirements: • VMware to launch a customized Slingshot Linux distribution (VMware Workstation Pro, VMware Workstation Player, or VMware Fusion for macOS; trial versions of all three are available, and VMware Workstation Player is available for free for non-commercial use. • 30 GB free hard drive space • At least 8 GB RAM