Security Event Triage: Monitoring Network Application Services
Exploited network application services allow a malicious actor to establish covert channels and silently exfiltrate data. This course will show you how to use the service logs to quickly detect these attacks and closedown the open threat vectors.
What you'll learn
Network application services are both ubiquitous and exploitable. If successfully compromised by a sophisticated threat actor they provide the means for establishing C2 channels and exfiltrating company information.
In this course, Security Event Triage: Monitoring Network Application Services, you will learn foundational knowledge of the tools and techniques you can apply to detect when and how these essential services have been compromised.
First, you will learn the techniques an APT agent can employ in order to exploit the different types of network application services. Next, you will discover what the security events written to the log files can reveal about the attack that’s unfolding. Finally, you will explore how to use freely available tools to analyze events from across the network to differentiate the good from the bad in terms of the malicious use of these services. When you’re finished with this course, you will have the skills and knowledge of monitoring network application services needed to protect your organization from sophisticated cyberattacks seeking to exploit these essential network protocols.
Table of contents
- Module Overview 1m
- Establishing a Covert Channel Over DNS 6m
- Understanding DNS Covert Channels 6m
- Sigma Rules for DNS C2 Attacks 2m
- BIND DNS Channel Detection with Postman 6m
- Analyzing BIND DNS with JupyterLab 6m
- Using Windows Events for DNS Monitoring 3m
- Visualizing the C2 Channel 4m
- Identifying the Compromised Clients 3m
- Module Summary 2m