Purpose Statement
Overview
You will learn the incident response process, from building an incident response kit and developing an incident response team, to identifying, containing, and recovering from incidents. We then steer away from a traditional “defensive-only” approach to introduce you to the attacker’s world, covering basic information on reconnaissance, scanning and enumeration, attacks and maintaining persistence, evading antivirus, and maintaining stealth.
Dave starts by walking you through pre-incident planning and developing an incident response team. He then walks you through the management of incidents, including identification, containment, and eradication. You then learn proper methods for recovering from incidents, and spend some time in hands-on labs getting familiar with incident response and digital forensic techniques. You will then get an introduction to the Mitre Att&ck Framework, including a deep dive into Threat Intelligence. Continuing the journey on the offensive side of things, you learn about scanning with NMAP and get some hands-on experience in a lab. You then learn about different attack types, ways to maintain persistence, evasion techniques, and how to be stealthier using techniques like Ghostwriting. The path wraps up with an overview of forensic tools.