Network Forensics
Configure and run open-source Snort and write Snort signatures
Configure and run open-source Zeek to provide a hybrid traffic analysis framework
Understand TCP/IP component layers to identify normal and abnormal traffic
Use open-source traffic analysis tools to identify signs of an intrusion
Comprehend the need to employ network forensics to investigate traffic to identify a possible intrusion
Use Wireshark to carve out suspicious file attachments
Write tcpdump filters to selectively examine a particular traffic trait
Craft packets with Scapy
Use the open-source network flow tool SiLK to find network behavior anomalies
Use your knowledge of network architecture and hardware to customize placement of IDS sensors and sniff traffic off the wire
How to identify potentially malicious activities for which no IDS has published signatures
How to place, customize, and tune your IDS/IPS for maximum detection
Hands-on detection, analysis, and network forensic investigation with a variety of open-source tools
TCP/IP and common application protocols to gain insight about your network traffic, enabling you to distinguish normal from abnormal traffic
The benefits of using signature-based, flow, and hybrid traffic analysis frameworks to augment detection
Concepts of TCP/IP
Why is it necessary to understand packet headers and data?
TCP/IP communications model
Data encapsulation/de-encapsulation
Discussion of bits, bytes, binary, and hex
Introduction to Wireshark
Navigating around Wireshark
Examination of Wireshark statistics
Stream reassembly
Finding content in packets
Network Access/Link Layer: Layer 2
Introduction to 802.x link layer
Address resolution protocol
ARP spoofing
IP Layer: Layer 3
IPv4
Examination of fields in theory and practice
Checksums and their importance, especially for an IDS/IPS
Fragmentation: IP header fields involved in fragmentation, composition of the fragments, fragmentation attacks
IPv6
Comparison with IPv4
IPv6 addresses
Neighbor discovery protocol
Extension headers
IPv6 in transition
Wireshark Display Filters
Examination of some of the many ways that Wireshark facilitates creating display filters
Composition of display filters
Writing BPF Filters
The ubiquity of BPF and utility of filters
Format of BPF filters
Use of bit masking
TCP
Examination of fields in theory and practice
Packet dissection
Checksums
Normal and abnormal TCP stimulus and response
Importance of TCP reassembly for IDS/IPS
UDP
Examination of fields in theory and practice
UDP stimulus and response
ICMP
Examination of fields in theory and practice
When ICMP messages should not be sent
Use in mapping and reconnaissance
Normal ICMP
Malicious ICMP
Real-World Analysis -- Command Line Tools
Regular Expressions fundamentals
Rapid processing using command line tools
Rapid identification of events of interest
Scapy
Packet crafting and analysis using Scapy
Writing a packet(s) to the network or a pcap file
Reading a packet(s) from the network or from a pcap file
Practical Scapy uses for network analysis and network defenders
Advanced Wireshark
Exporting web objects
Extracting arbitrary application content
Wireshark investigation of an incident
Practical Wireshark uses for analyzing SMB protocol activity
Tshark
Detection Methods for Application Protocols
Pattern matching, protocol decode, and anomaly detection challenges
DNS
DNS architecture and function
Caching
DNSSEC
Malicious DNS, including cache poisoning
Microsoft Protocols
SMB/CIFS
MSRPC
Detection challenges
Practical Wireshark application
Modern HTTP and TLS
Protocol format
Why and how this protocol is evolving
Detection challenges
SMTP
Protocol format
STARTTLS
Sample of attacks
Detection challenges
IDS/IPS Evasion Theory
Theory and implications of evasions at different protocol layers
Sampling of evasions
Necessity for target-based detection
Identifying Traffic of Interest
Finding anomalous application data within large packet repositories
Extraction of relevant records
Application research and analysis
Hands-on exercises after each major topic that offer students the opportunity to reinforce what they just learned.
Network Architecture
Instrumenting the network for traffic collection
IDS/IPS deployment strategies
Hardware to capture traffic
Introduction to IDS/IPS Analysis
Function of an IDS
The analyst's role in detection
Flow process for Snort and Zeek
Similarities and differences between Snort and Zeek
Snort
Introduction to Snort
Running Snort
Writing Snort rules
Solutions for dealing with false negatives and positives
Tips for writing efficient rules
Zeek
Introduction to Zeek
Zeek Operational modes
Zeek output logs and how to use them
Practical threat analysis
Zeek scripting
Using Zeek to monitor and correlate related behaviors
Hands-on exercises, one after each major topic, offer students the opportunity to reinforce what they just learned.
Introduction to Network Forensics Analysis
Theory of network forensics analysis
Phases of exploitation
Data-driven analysis vs. Alert-driven analysis
Hypothesis-driven visualization
Using Network Flow Records
NetFlow and IPFIX metadata analysis
Using SiLK to find events of interest
Identification of lateral movement via NetFlow data
Examining Command and Control Traffic
Introduction to command and control traffic
TLS interception and analysis
TLS profiling
Covert DNS C2 channels: dnscat2 and Ionic
Other covert tunneling, including The Onion Router (TOR)
Analysis of Large pcaps
The challenge of analyzing large pcaps
Students analyze three separate incident scenarios.
Last updated