ＨｉｄｅＺｅｒｏＯｎｅ

This course helps create and understand low-level Linux attack paths, improve your Linux detection coverage, see in action many Open Source DFIR/defensive projects, and understand the need for Linux telemetry, especially including Kubernetes clusters where Runtime Security solutions are a must these days. The techniques and attack paths covered in this training include many different implementations of eBPF, XDP, Ftrace, Kprobe, Uprobe, Netfilter, Systemtap, PAM, SSHD, HTTPD/Nginx, LD_PRELOAD-based code samples, and PoCs. Detection and forensics layers include LKRG, bpftool, Velociraptor IR, OSQuery, CLI-based /proc/ and /sys/ analysis, memory forensics with Volatility  2/3 Framework with the semi-automated RAM acquisition, Sysmon4Linux, Falco, Tracee, Sysdig, Tetragon, Sandfly Security, Zeek IDS, Suricata IDS, Moloch/Arkime FPC, Yara rules and more.

This advanced course is designed for digital forensics professionals looking to enhance their expertise beyond foundational skills. It delves into sophisticated forensic methods, including advanced file system analysis, memory forensics, network traffic analysis, and reverse engineering. Participants will learn cutting-edge techniques for identifying, preserving, and analyzing digital evidence in complex cybercrime investigations. Through hands-on labs and real-world case studies, students will develop a deeper understanding of forensic tools and methodologies, empowering them to solve intricate incidents, conduct in-depth investigations, and provide expert testimony in legal settings.

The objective of this course is to show students how to perform a full digital forensic investigation of a Windows system in a complete DIY setup.

The course covers a full digital forensic investigation of a Windows system. It begins with the simple preparation of our lab, which consists of setting up a “victim” VM and a forensic workstation. We’ll then run an attack simulation script on the victim VM that simulates attack patterns as commonly observed by threat actors in the industry to create a realistic setting for our investigation. From there, we’ll kick off the forensic process, beginning with the data collection, examination and extraction before diving deeper into the analysis of the information at hand.

A good primer on OSINT, this course explains what Open Source Intelligence is and also covers types of OSINT sources, ethics and grey areas, useful tools available for OSINT information gathering including Google custom searches. The course will also cover cases and scenarios allowing the student to see how intelligence they have gathered can be used/ seen in different contexts. Students will also be exposed to tools like Maltego, FOCA and cree.py and work on labs where they will build their own fake/ puppet LinkedIn profile for intelligence gathering purposes, build a Google Custom Search Engine and gather intelligence on a large organization. Students will take away an appreciation for OSINT, why it needs to be a part of their toolbox, an intelligence gathering recipe and exposure to tools and techniques they can start using right away.