Masterclass: PowerShell for Digital Investigation & Threat Hunting

This Live Virtual Class consists of 12 Modules in terms of PowerShell for Digital Investigation & Threat Hunting. They include essential theory combined with individual practice during the exercises as well as loads of hands-on tools and real-case scenarios.

Module 1. APT Attacks & Investigation

1. Understanding the advanced persistent threats.
2. The attacker's tactics, techniques & procedures (MITRE ATT&CK)
3. The APT Attack Vectors
4. Real world scenario of Targeted Ransomware Attack

Module 2. PowerShell 101 for Blue Teams

1. PowerShell syntax and scripting basics
2. Cmdlets, pipelines, and execution policies
3. Profiles and security configurations
4. Condition Statements & Loops

Module 3. Understanding information gathering and timelining

1. The main goals of digital forensics and timeline analysis
2. Deep Dive into NTFS Artifacts for Hidden Malware Files
3. Analyzing Prefetch files to detect loaded processes
4. Extracting Timestamps from Master File Table (MFT)
5. Hunting Deleted Malware Files via $LogFile & $UsnJrnl

Module 4. Powershell For Digital Forensics & Artifacts Collection

1. File and directory enumeration
2. File metadata and alternate data streams
3. Hashing and comparing files
4. Timestamp analysis
5. Accessing registry keys and values
6. Run keys & Shellbags
7. Parsing with PowerShell scripts

Module 5. Process & Network Artifact Collection

1. PowerShell Mapping Parent-child process relationships
2. Verifying Process Signatures using PowerShell
3. Command line auditing
4. Detecting Malicious Loaded Libraries (DLLs)
5. Network session monitoring (TCP/UDP)
6. Netstat, Get-NetTCPConnection, and equivalents
7. Netstat, Get-NetTCPConnection, and equivalents
8. Dump Process's Memory using PowerShell

Module 6. PowerShell Logging & Detection

1. PowerShell Event Logging (4104, 4688, etc.)
2. Windows Event Log queries
3. Detecting script block logging and encoded commands
4. Use Sigma Rules With PowerShell To Detect Suspicious Activities

Module 7. Threat Hunting with WMI & Scheduled Tasks

1. Querying WMI for suspicious activity
2. Identifying attacker persistence via scheduled tasks
3. Script-based detection of anomalies

Module 8. PowerShell For Enterprise

1. PowerShell Remoting For Secure Data Collection & Analysis
2. Execute Commands & Scripts Across The Enterprise
3. Utilize Digital Forensics Tools & Libraries Like Kansa & KAPE
4. Secure Your Connections From Stolen Credentials

Module 9. Hands-On Threat Hunting Case Study

1. Detecting LOLBins and encoded PowerShell
2. Hands-on lab: analyzing logs and artifacts
3. Practical attacker techniques walkthrough

Module 10. Active Directory Enumeration with PowerShell

1. Domain enumeration techniques
2. AD object and group discovery
3. Trust relationships and policies
4. Detecting Lateral Movement Possibilities with Weak ACLs
5. Intro To AzureAD Enumeration For Privilege Escalation

Module 11. Red Teaming Tactics with PowerShell

1. AMSI bypasses, obfuscation, and logging evasion
2. Attack path simulation and detection using Atomic Red Team (Purple Teaming)
3. Living-off-the-land tools and script evasion
4. PowerShell Without PowerShell For Defense Evasion

Module 12. Complete Fileless Attack Analysis Walkthrough

1. Analyze an Obfuscated PowerShell 1st Stage
2. Handling Encryption, Compression & Encoding Algorithms For Script Analysis
3. Investigate Process Injection In PowerShell
4. Summary, wrap-up, and Final Report