deep knowledge technical trainings

AUGUST 22 / 23 / 24 / 25 @ INTERCONTINENTAL SINGAPORE

Linux Forensics Inspection and Incident Response at Scale

This course takes on an “attack vs detection” approach in a condensed format. This class is intended for students who have basic understanding of Linux and have to deal with advanced threats. Furthermore, the course is also interesting for experienced DFIR/SOC/CERT players who aim to dig deeper into understanding of Linux internals and corresponding network attack analysis techniques, detection and response.

Categories 3-Day Training, HITB2022SIN, In-person

$3,299.00

Duration

3-day

Delivery Method

In-Person

Level

intermediate

Seats Available

20

REGISTRATION CLOSED

DATE: 22-24 Aug 2022

TIME: 09:00 to 17:00 SGT/GMT +8

Date	Day	Time	Duration
22 Aug	Monday	09:00 to 17:00 SGT/GMT +8	8 Hours
23 Aug	Tuesday	09:00 to 17:00 SGT/GMT +8	8 Hours
24 Aug	Wednesday	09:00 to 17:00 SGT/GMT +8	8 Hours

Full access to the PurpleLabs environment for 30 days post-training!

Through the hands-on labs, you will gain a perfect understanding of important DFIR Linux/Network internals and investigation steps needed to get the full picture of post-exploitation activities and artifacts left behind. At scale.

Attackers constantly find new ways to attack and infect Linux boxes using more and more sophisticated techniques and tools. As defenders we need to stay up to date with adversaries, understand their TTPs and be able to respond quickly. The combination of low-level network and endpoint visibility is crucial to achieve that goal. For DFIR needs we could go even further with proactive forensics inspections. This training will guide you through different attack-detection-inspection-response use-cases and teach critical aspects of how to handle Linux incidents properly.

For a comprehensive mindmap of this training, click here

Topics Covered

Introduction to PurpleLabs Hunting and Detection tools including Velociraptor, Wazuh, HELK+Sigma, Splunk, Elastiflow, Moloch/Arkime, Kolide Fleet, Graylog, theHive, Sandfly and more
Linux profile baselining
How to run DFIR tasks at scale across many Linux endpoints
Recent Linux APT analysis
RE&CT Enterprise Matrix
The importance of timeline analysis and NTP synchronization
Triage / collecting artifacts
Privileged user and group enumeration
Identification of logged accounts
Searching for files at scale
Establishing a baseline for different OS components (cron, at, rc.local, ACLs, hosts, resolv.conf, SELinux, filesystem hashing, packages and checksums)
Process call chains / pstree / process arguments
Collecting and analyzing important process data (/proc)
Finding hidden processes, network connections and kernel modules
Detecting capabilities in ELF, shellcode files
Detecting loaded shared libraries per process
Dropping web shells vs File Integrity Monitoring
Hunting for packers, extracting binary versions and exports
Searching for exploitation attempts in logs
Hunting for Linux rootkits (user space / kernel space)
Hunting for artifacts of process injection techniques
Sysmon Events + Linux Sigma detection rules
Runtime Security Analysis (Falco, Tracee) for host and docker containers
Syscall filtering
Open source ways for memory acquisition and memory forensics
Creating Volatility profiles
Filesystem and Linux process memory yara scans
Linux Endpoint data correlation and hunting for suspicious network events
Network visibility with / without signature rules
Searching for different persistence methods in use
Data correlation and hunting for suspicious network events + RITA
Direct interaction with endpoint: command execution on demand, system modification and active quarantine examples
Hunts enrichment
Using theHive for incident management

Dr Kailong Wang

Researcher

National University Singapore

Dr. Wang Kailong is currently a research fellow at National University of Singapore (NUS). He received his PhD degree from School of Computing NUS in 2022. He has worked as a Research Assistant in NUS while pursuing his PhD degree from 2016 to 2021. His research interests include mobile and web security and privacy, and protocol verification. His works have appeared in the top conferences such as WWW and MobiCom.

Gal Diskin

Co-Founder & CTO

Authomize

Mr. Gal Diskin is a cybersecurity and AI researcher. He was previously the VP & head of Palo Alto Networks’ Israeli site, and is a serial entrepreneur. Mr. Diskin’s research has been featured in HITB, Defcon, Black Hat, CCC, and other conferences, spanning fields from low level security research such as hardware vulnerabilities, binary instrumentation, and car hacking to high level research on AI detection methods, Enterprise security, and Identity security. Mr. Diskin was also the technical lead and co-founder of Intel’s software security organization, as well as the CTO of Cyvera and HeXponent (co-founder) before their acquisition.

Kevin Chen

Senior Security Researcher

Huajiang “Kevin2600” Chen (Twitter: @kevin2600) is a senior security researcher. He mainly focuses on vulnerability research in wireless and Vehicle security. He is a winner of GeekPwn 2020 and also made to the Tesla hall of fame 2021. Kevin2600 has spoken at various conferences including KCON; DEFCON and CANSECWEST.

Why You Should Take This Course

This course takes on an “attack vs detection” approach in a condensed format. This class is intended for students who have basic understanding of Linux and have to deal with advanced threats. Furthermore, the course is also interesting for experienced DFIR/SOC/CERT players who aim to dig deeper into understanding of Linux internals and corresponding network attack analysis techniques, detection and response.

Who Should Attend

CSIRT / Incident Response Specialists
Red and Blue team members
Penetration testers
Threat Hunters
Security / Data Analytics
IT Security Professionals, Experts & Consultants
SOC Analysts and SIEM Engineers
AI / Machine Learning Developers
Open Source Security Enthusiasts

Key Learning Objectives

[“Get to know the newest Linux attack paths and hiding techniques vs proactive detection”,”Learn current trends, techniques, and offensive tools for Discovery, C2, Lateral Movement, Persistence, Evasion, Exfiltration, Execution, Credential Access against Linux machines ← Linux Matrix ATT&Ck Framework”,”Learn ways to improve detection and sharpen your event correlation skills across many different Linux\/network data sources”,”Get to know visibility\/detection methods and capabilities of well recognized Hunting and Detection tools including Velociraptor, HELK+Linux Sigma, Splunk, Elastiflow, Moloch\/Arkime, Kolide Fleet, Wazuh, Graylog, theHive, Sandfly”,”Find the malicious Linux activities and identify threat details on the network”,”Prepare your SOC team for fast filtering out Linux network noise and allow for better incident response handling”,”Find out how Detection \/ DFIR Open Source Software can support your SOC infrastructure”,”Understand values of proactive linux forensics scans vs manual and automated approach to simulate attackers and generate anomalies”,”Identify Linux blind spots in your network security posture”]

Prerequisite Knowledge

An intermediate level of command-line syntax experience using Linux.
Fundament knowledge of TCP/IP network protocols.
Penetration testing experience performing enumeration, exploiting, and lateral movement is beneficial, but not required.
Basic programming skills are a plus, but not essential.

Hardware / Software Requirements

This training is based on dedicated PurpleLABS virtual infrastructure so there are no special student’s desktop requirements. No more initial setup issues, just a pure training experience. Every student will gain full access to the PurpleLabs environment for 30 days after the training.
VPN client installed according to VPN Setup instructions or just a browser
Slack account as an invite to dedicated training channel will be sent
Stable internet connection

deep knowledge technical trainings

AUGUST 22 / 23 / 24 / 25 @ INTERCONTINENTAL SINGAPORE

Linux Forensics Inspection and Incident Response at Scale

Duration

3-day

Delivery Method

In-Person

Level

intermediate

Seats Available

20

REGISTRATION CLOSED

DATE: 22-24 Aug 2022

TIME: 09:00 to 17:00 SGT/GMT +8

Full access to the PurpleLabs environment for 30 days post-training!

Through the hands-on labs, you will gain a perfect understanding of important DFIR Linux/Network internals and investigation steps needed to get the full picture of post-exploitation activities and artifacts left behind. At scale.

Topics Covered

Dr Kailong Wang

Researcher

National University Singapore

Gal Diskin

Co-Founder & CTO

Authomize

Kevin Chen

Senior Security Researcher

Why You Should Take This Course

Who Should Attend

Key Learning Objectives

Prerequisite Knowledge

Hardware / Software Requirements

SEE YOU IN SINGAPORE

Interested in being a sponsor or exhibitor? Email us to request for a sponsorship kit!

GOLD SPONSORS

CTF & CTF PRIZE SPONSOR

TCP/IP RECEPTION SPONSOR

SILVER SPONSORS

EXHIBITORS

Copyright 2023 © All rights Reserved. Hack In The Box