Your organization has just implemented the leading detection and response products. Are they configured with default configuration? How much faith should you have in your ability to detect sophisticated attacks? How would you simulate attacks to ensure robust detections are in place? This course will teach the importance of understanding the inner workings of attack techniques and telemetry availability and provide a workflow for developing robust detection analytics or data driven evasion decisions. Focusing on various Windows components and attacker TTPs, you will dive deep into how software abstracts underlying capabilities and how attackers can interact with deeper layers to bypass superficial detection capabilities.

Course Summary

Knowledgeable detection engineers and red team operators know that while there are many effective products, all of them have gaps that can be exploited by a sophisticated adversary. A mature security program must continuously test and enhance product detection configurations to have an effective response capability. Unfortunately, they often run into a number of limitations, primarily in a lack of understanding of the:

attack technique itself
telemetry used for each detection
effectiveness of the detection

The result often leads to blind spots within the detection and response capabilities, ineffective detection strategy, and a false sense of security in the organization's ability to respond to advanced threat actors. When simulating sophisticated attacks, red team operators need to truly understand how a given technique works, the telemetry/artifacts it generates, and the strategies and biases that a defender might use to detect a technique. How organizations may respond to attackers is crucial in red team attack planning, technique selection, and evasion.

In Adversary Tactics: Tradecraft Analysis, we will present and apply a general tradecraft analysis methodology for offensive TTPs, focused on Windows components. We will discuss Windows attack techniques and learn to deconstruct how they work underneath the hood. For various techniques, we will identify the layers of telemetry sources and learn to understand potential detection choke points. Finally, the course will culminate with participants creating their own technique evasion and detection strategy. You will be able to use the knowledge gained to both use your telemetry to create robust detection coverage across your organization, and truly assess the efficacy of that coverage.

Whether you are a red team operator or detection engineer, you will have a comprehensive understanding of several attack chains. Red team operators will learn an approach to analyzing their own tools, a better understanding of which techniques to select to evade detection, and how to better describe to defenders why an evasion was successful. Detection engineers will understand how to craft a strategy to create robust detections and better detect families of attacks.

Course Syllabus

Day 1:

Attack and Detection Strategies
Native PSExec Overview
Tradecraft Analysis Process
Capability Identification
Capability Deconstruction
IPC Mechanisms

Day 2:

Securable Objects
Identifying Choke Points
Telemetry Source Identification
How EDR Tools Work
Organic Logging
SACLs
Function Hooking
Kernel Callback Functions
ETW

Day 3:

Operationalizing Telemetry
Understanding Attacker Controlled Fields
Operationalizing Detection Research
Operationalizing Evasion Research
Understanding the Triage, Investigation, and Remediation Process
Evading the Response Process
Documentation and Evaluation Metrics
Detection Documentation
Evasion Documentation

Day 4:

Capstone Exercise

SOCON Training Benefits

This course is a part of the SO-CON 2024 event. Attend the SO-CON 2024 conference for FREE by adding the SO-CON 2024 ticket to your training order!

Capture the Flag Challenge

You up for a challenge? Bring your A-game as you solve complex puzzles, exploit vulnerabilities, and race against the clock to capture flags. Prepare to hack the planet through a narrative-driven series of challenges designed to test your cybersecurity expertise.
Join this immersive and educational exercise for FREE as a SO-CON conference or training participant!
Full details, prizes, and registration will be shared soon.

Bring Your Own Research Session

Do you have some research or an innovative infosec concept you're excited to share? Or maybe there's that idea you're itching to discuss with folks?
As an in-person SO-CON training attendee, you are invited to participate in our "Bring Your Own Research" session. Here you'll have the opportunity to present, discuss, and exchange ideas about your research or concept with a gathering of Specters and fellow training participants. Is there a better way to spend an evening than with a blend of constructive feedback and fun conversations?
Full details and sign-ups forthcoming!

Participant Requirements

This course is intended for expert blue teamers, detection engineers, and red team operators. Participants should be familiar with detection engineering and/or red team operations, and be generally comfortable with Windows internals, attack technique analysis, offensive tools and techniques

Hybrid (Virtual) Attendance

If traveling to Arlington, VA isn't feasible, you can opt to take this course virtually online through Zoom. You will receive the same training portal access and watch the live instruction. However, the virtual training is not part of SO-CON - remote attendees will NOT receive any of the exclusive benefits that come with in-person training, including a free ticket to the SO-CON summit, exclusive SO-CON swag, access to the capture the flag challenge, or a chance to participate in the Bring Your Own Research session.
Remote attendees will receive logistics emails and credentials the week before the trainings.

In-person SO-CON 2024 Attendance vs. Remote Training Attendance Benefits

FAQs

How can I contact the organizer with any questions?

Please email training@specterops.io with any questions.

What's the refund policy?

Full refunds will be provided up to 7 days before the course start date.

What are the hardware requirements for attending the course?

Courses are based in the SpecterOps training portal and accessible via an internet connection; no VMs are required for labs. The following are recommended hardware requirements:

Internet Connection
8GBs of RAM
Modern Web Browser capable of rendering HTML5