Building resilient and automated detection capabilities requires a detailed understanding of attackers and their known or expected behavior. By thinking like an attacker, understanding the different techniques and procedures used by attackers and what indicators can be extracted, better detection capabilities can be developed.
This process is called Detection Engineering and it is a crucial aspect to be truly effective at discovering attackers in your network.
Our training focuses on the entire methodology of the detection engineering cycle. We guide participants in defining a scope, researching the relevant (sub-)techniques, building the detection analytic, investigating which logs can be utilized, and validating the resilience of the analytic against evasion. Maintenance, testing and improvement is part of proper engineering as well as documentation. What to do when an alert triggers is as important to describe as what you are trying to detect in the first place.
Interactive training
The training is highly interactive and retains a good balance between theory and a lot of hands-on exercises, in which the students execute all attacks themselves in a dedicated lab environment.
These exercises are extensively documented in our lab guide and provide the option to get hints and (partial) solutions where needed. This allows the students to get familiar with the detection engineering methodology and prepare them to start implementing this practice at their organizations.
In the training we mix theory, discussion and lots of hands-on exercises in our training lab. Students will receive:
- Reference materials.
- Training slides.
- Step-by-step digital lab guide.
- Access to their own lab environment.
- All tools and scripts used in the training.
The following topics will be covered in the training:
Detection Engineering Methodology
- Introduction
- Detection Engineering principles
- Testing, Maintenance and Improvement
- Automation
Endpoint
- Initial Access
- Command and Control use and detection
- Credential Dumping
- Lateral Movement
Active Directory and server-side attacks
- Kerberos attacks
- Active Directory Certificate Services (ADCS)
Cloud Infrastructure
- Microsoft Entra ID (f.k.a. Azure Active Directory) abuse and misconfigurations
- Azure KeyVault and Storage Accounts
- Azure Virtual Machine attacks
The training covers a full, realistic attacker scenario in an enterprise environment: from the endpoint, through the Active Directory and into the cloud environment.
FalconForce successfully facilitated this training at both well-known security conferences, such as Black Hat US, as well as at various private organizations in different sectors.
