Hunt The Hacker (inglise keeles)

A practical training that teaches attendees how to discover hackers that have bypassed existing security mechanisms, and are now operating invisibly within the internal network. Brought to you by professional hackers!

Training duration: 2 days (16 academic hours) of instruction, predominantly in the form of hands-on hunting labs.

Group size: 12 participants maximum

Target audience: Everybody who needs to know more about what threat hunting is, why it is necessary, what is required to start doing it, and how it should be done. Appropriate roles include: CISOs, Security Managers, SOC staffers, Incident Responders, Forensic Analysts and System Administrators.

Pre-requisites: To maximize value to the attendee, prior HOHE participation is highly recommended, but not mandatory.

The training is held by our partner Clarified Security.

Contents of the training

Participants learn how to hunt hackers within our Windows and Linux lab network, using a range of highly effective threat hunting technologies and techniques, looking for real life attacks.

Technologies used:

Sysmon : Sysmon is the go-to solution for hunters working with Windows machines, and is the technology that Microsoft itself uses to hunt hackers within their own networks.

Elastic stack, formerly “ELK” : The Elastic Stack is a suite of mature open source technologies that is popularly used for hunting by big name companies. The principles that are taught in this course using the Elastic Stack are also more generally applicable to other data lake products such as Splunk, Sumo and others.

Elastic Security : The Elastic Security adds SIEM and Endpoint security capabilities to Elastic stack and enables threat hunters to collect data, detect anomalies, respond to threats, analyse and correlate large number of datapoints all in one ecosystem.

Osquery : Osquery is an infrastructure monitoring framework created by Facebook. Osquery enables low-level operating system monitoring by exposing the operating system as a high-performance relational database which can be easily queried using SQL syntax.

Hunting techniques:

Known bad : Students will learn how to research and develop hunts for known indicators of attack.

Known good : Students will learn how to “find evil by knowing normal”, using various processes of elimination to reduce a set of raw collected data down to “not known good”. Students will then determine through investigation whether the remaining data constitute indicators of attack or benign in nature. Benign items are labeled as “known good” so that they need not be investigated again.

Outliers : Outlier detection is the “power technique” of threat hunting. Students will learn how to leverage statistical analysis in order to force anomalies in large-scale sets of data to become apparent, which will commonly highlight indicators of attack.

It is important to note that although this course focuses on Linux and Windows endpoints, the building-block technological capabilities and hunting principles are equally applicable on MacOS and others.

Training methods

The trainers engage participants with lectures, live demonstrations and Q&A sessions. Each participant spends the majority of their time performing a wide variety of hands-on hunts.

Intended outcome

Participants will understand what threat hunting is, be utterly convinced of the need for it, know what infrastructure is required to facilitate it, and be able to start doing it with confidence within their own organizations.

Training environment

The training environment is a remotely accessed lab that can be used by participants anywhere in the world as long as VPN connection via decent Internet connectivity is viable. The hunting lab is hosted on Clarified Security’s own virtualized infrastructure. Each student has their own account on the shared environment, made up of a Windows domain plus threat hunting infrastructure.

Come and learn how to detect hackers within your internal networks, taught by professional hackers!

Koolitusel osalejad saavad elektroonilised õppematerjalid siis, kui koolitus on läbitud. Iga koolituse lõpus saavad osalejad koolituse läbimist tõendava tunnistuse (Certificate of Completion) ning parim häkker/hunter grupis saab ka auhinna.

Technical requirements for the training

Võta kindlasti kaasa oma sülearvuti, laadija ja vajadusel ka muu tööks vajalik (hiir, jms). Sülearvutil peab olema võrgukaabli pesa või võimekus ühenduda Wi-Fi võrku ning ekraani resolutsioon vähemalt 1920×1080.
Kõik operatsioonisüsteemid on sobivad, peamine on kaugtöölauakliendi olemasolu.
Kogu koolitustegevus toimub meie koolituskeskkonnas. Juhul kui Sul on soov omale eelnevalt kaugtöölauaklient arvutisse paigaldada, on meie soovitusteks:
• Linux: Remmina, rdesktop
• macOS: Microsoft Remote Desktop client (Saadaval Mac App Stores)
• Windows: Windows 10 sisseehitatud

Täienduskoolituse õppekavarühm: Informatsiooni- ja kommunikatsioonitehnoloogia interdistsiplinaarne õppekavarühm