CBRTHD - Conducting Threat Hunting and Defending using Cisco Technologies for CyberOps

Threat Hunting Theory

• Threat Hunting Concepts
• Threat Hunting Types
• Conventional Threat Detection vs Threat Hunting

Threat Hunting Concepts, Frameworks and Threat Models

• Cybersecurity Concepts
• Common Threat Hunting Platforms
• Threat Hunting Frameworks
• Threat Modeling
• Case Study: Use the PASTA Threat Model

Threat Hunting Process Fundamentals

• Threat Hunting Approaches
• Threat Hunting Tactics and Threat Intelligence
• Defining Threat Hunt Scope and Boundaries
• Planning the Threat Hunt Process

Threat Hunting Methodologies and Procedures

• Investigative Thinking
• Identify Common Anomalies
• Analyze Device and System Logs
• Determine the Best Threat Hunt Methods
• Automate the Threat Hunting Process

Network-Based Threat Hunting

• Operational Security Considerations
• Performing Network Data Analysis and Detection Development
• Performing Threat Hunting in the Cloud

Endpoint-Based Threat Hunting

• Threat Hunting for Endpoint-Based Threats
• Acquiring Data from Endpoint
• Performing Host-Based Analysis

Endpoint-Based Threat Detection Development

• Analyze Endpoint Memory
• Examining Systems Memory Using Forensics
• Developing Endpoint Detection Methods
• Uncovering New Threats, Indicators and Building TTPs

Threat Hunting with Cisco Tools

• Threat Hunting with Cisco Tools
• Cisco XDR Components

Threat Hunting Investigation Summary: A Practical Approach

• Conducting a Threat Hunt

Reporting the Aftermath of a Threat Hunt Investigation

• Measure the Success of a Threat Hunt
• Report Your Findings
• Threat Hunting Outcomes

• Discovery Lab 1: Categorize Threats with MITRE ATTACK Tactics and Techniques
• Discovery Lab 2: Compare Techniques Used by Different APTs with MITRE ATTACK Navigator
• Discovery Lab 3: Model Threats Using MITRE ATTACK and D3FEND
• Discovery Lab 4: Prioritize Threat Hunting Using the MITRE ATTACK Framework and Cyber Kill Chain
• Discovery Lab 5: Determine the Priority Level of Attacks Using MITRE CAPEC
• Discovery Lab 6: Explore the TaHiTI Methodology
• Discovery Lab 7: Perform Threat Analysis Searches Using OSINT
• Discovery Lab 8: Attribute Threats to Adversary Groups and Software with MITRE ATTACK
• Discovery Lab 9: Emulate Adversaries with MITRE Caldera
• Discovery Lab 10: Find Evidence of Compromise Using Native Windows Tools
• Discovery Lab 11: Hunt for Suspicious Activities Using Open-Source Tools and SIEM
• Discovery Lab 12: Capturing of Network Traffic
• Discovery Lab 13: Extraction of IOC from Network Packets
• Discovery Lab 14: Usage of ELK Stack for Hunting Large Volumes of Network Data
• Discovery Lab 15: Analyzing Windows Event Logs and Mapping Them with MITRE Matrix
• Discovery Lab 16: Endpoint Data Acquisition
• Discovery Lab 17: Inspect Endpoints with PowerShell
• Discovery Lab 18: Perform Memory Forensics with Velociraptor
• Discovery Lab 19: Detect Malicious Processes on Endpoints
• Discovery Lab 20: Identify Suspicious Files Using Threat Analysis
• Discovery Lab 21: Conduct Threat Hunting Using Cisco Secure Firewall, Cisco Secure Network Analytics, and Splunk
• Discovery Lab 22: Conduct Threat Hunt Using Cisco XDR Control Center and Investigate
• Discovery Lab 23: Initiate, Conduct, and Conclude a Threat Hunt