Threat Hunting: Endgame

Threat Hunting: Endgame

In this room, you will learn how to implement the threat hunting process to hunt malicious activities performed in the "Actions on Objectives" phase of the "Cyber Kill Chain". You will also experience the hunting process of commonly used MITRE ATT&CK techniques under the collection, exfiltration and impact tactics. The ultimate objective of the room is to teach how to conduct a threat hunting investigation to detect attackers' main objectives in the system.

Learning Objectives

• Gain applied hands-on threat hunting investigation skills.
• Familiarise yourself with the "Actions on Objectives" phase.
• Familiarise yourself with correlating and evaluating artefacts for a hypothesis.
• Experience the threat hunting process for a defined scope.

Room Prerequisites

• Windows Event Logs
• Windows Forensics 1 & 2
• Core Windows Processes
• Sysmon
• Sysinternals
• MITRE
  
• Threat Emulation Module