Senior Instructor
Owen Dubiel
Security Engineer
Owen Dubiel is a passionate security practitioner who is going on 8 years of experience in the cybersecurity industry.
See More
Rating
36
courses
courses
Courses
Search Open Technical Databases: Scan Databases
This course covers various aspects of the Search Open Technical Databases: Scan Databases TTP, including its components, associated risks, and detection techniques. Participants will learn how to detect and mitigate the risks associated with this TTP (T1596.005) and techniques for validating alerts and conducting pre and post-alert preparations.
Application Layer Protocol: Web Protocols
In this course, students will learn how C2 connections are established and used by attackers in a real-world demonstration to give learners a sense of how to detect malicious HTTP traffic. This is the last course in the Raspberry Robin Attack series.
Command and Scripting Interpreter: Windows Command Shell
In this course, you will learn how the native CMD scripting language for Windows can be abused to allow an attacker to execute remote commands, establish persistence and create autorun files to carry out an attack within the Raspberry Robin attack cycle.
System Binary Proxy Execution: Rundll32
In the course, you will learn how a malicious user can obfuscate some of their payload actions through downloaded DLL files using the built-in rundll32.exe. Using rundll32, an attacker can make their activity look like a normal Windows system binary process being executed under rundll32.
System Binary Proxy Execution: Msiexec
In the course, you will learn how a malicious user can obfuscate some of their payload actions through downloaded DLL files by utilizing the built in rundll32.exe. By using rundll32, an attacker can make their activity look like a normal Windows system binary process being executed under the rundll32.
Replication Through Removable Media
In this course, students will learn the basics of how an adversary can use removable media devices to not only gain access to an unauthorized host, but also enable autorun scripts to download additional infrastructure and payloads to a victim host.
Local Accounts
Organizations that do not enforce strong password policies and audit privileged account management can fall victim to attackers who leverage access to local accounts. With it, they can gain initial access, persistence, privilege escalation, or defense evasion. Learn how to detect and prevent this type of activity in this dynamic lab-based course.
Scheduled Task
Some organizations do not configure their operating systems and account management to properly protect the use of task scheduling functionality. As a result, adversaries can abuse this capability to execute malicious code on a victim’s system. Get hands-on practice detecting this technique so you can protect your organization.
User Discovery
Once on a victim's system, adversaries will perform user discovery to determine information, such as the primary user’s identity and capabilities. They may seek out users with access to remote systems so they can cast their net wider. Discover the attacker instead of the other way around with this dynamic, lab-based course!
Lateral Tool Transfer
Once adversaries compromise your network, they can transfer tools between systems in order to stage them for later use or to support lateral movement. They may use file sharing protocols or copy files with existing tools like scp, sftp and ftp. Learn how to spot and mitigate this behavior so you can stop adversaries in their tracks.
Obtain Capabilities: Tool
While you may be prepared to detect the use of malware on your system, what if an adversary uses a legitimate software tool for a nefarious purpose? Adversaries may buy or steal software and use it in unexpected ways. Learn how adversaries leverage this technique so you can defend your organization.
Registry Run Keys
Many organizations do not monitor for additions to the Windows Registry that could be used to trigger autostart execution on system boot or logon. This allows adversaries to launch programs that run at higher privileges and paves the way for more damaging activity. Learn how to detect and mitigate this activity to secure your network.
Owen is certified in the GIAC GSEC, CompTIA CySA+, and various other vendor-related certifications. He works both as a technical security engineer and as an SME architect instructor in his spare time. Spreading the word of cyber security is a passion of his. Owen lives in Southeast Michigan with his beautiful wife, daughter, and his dog, Thor. In his free time, Owen enjoys watching sports and movies, and spending time with his family.