Testlab

Security information and event management tools
Threat intelligence tools
Threat hunting tools
Vulnerability management tools

Notes

Introduction
- What?
- Why?
- How?
Incident prevention
Threat intelligence lifecycle
Pyramid of pain
Cyber kill chain
MITRE ATT&CK framework
Unified kill chain
- Resources
Diamond model
Incident handling (NIST)
Standards of communication
- TAXII
- STIX
- Attack trees
SIEM stack
Threat hunting
- Proactive threat hunting
- Threat hunting steps

Code

Developing IPA project SIEM Stack

An investigation with Splunk

Introduction
- What?
- Why?
- How?
I am really not batman
- Cyber Kill Chain
Reconnaissance phase
- Questions
Exploitation phase
Installation phase
- Was this file executed on the server after being uploaded?
- Questions
Action on objectives
- Questions
Command and control phase
- Questions
Weaponisation phase
- Tools used
- Questions
Delivery phase
- OSINT sites
- Questions

TryHackMe rooms

Introduction
- What?
- Why?
- How?
VPN logs
ItsyBitsy
- Scenario
- Questions
Investigating with Splunk
- Questions
Benign
- Questions
CaddyWiper and APT37
Zerologon

CyberDefenders challenges

Introduction
- What?
- Why?
- How?
GrabThePhisher
L’espion
Intel101
CaseVegas
CyberCorp Case 2
- Scenario
- Resources
- Tools
- Setting up
- Questions

Boss of the SOC v2

Introduction
- What?
- Why?
- How?
Data dive
Web activity investigation
Detecting SQL and XSS web application attacks
USB attack investigation
Investigating FTP

Resources

Introduction
- What?
- Why?
- How?
Threat maps
Feeds
Blogs
Reports
Marketplaces

Security information and event management (SIEM)

SIEM
Blue Team
Improbability Blog
About the UU
Register

Introduction

What?

THM Room: BOTSv2: Version 2 of the Boss of the SOC (BOTS) competition by Splunk.

Why?

Advanced hunting APTs with Splunk.

How?

Data dive
Web activity investigation
Detecting SQL and XSS web application attacks
USB attack investigation
Investigating FTP

Previous Next

Unseen University, 2023, with a forest garden fostered by /ut7.